Re: Procfs race condition bug

From: Alexey Dobriyan
Date: Wed Jul 09 2014 - 08:17:24 EST

> I originally posted this two years ago (*) but received no response.
> I just had a look and the problem still exists on the 3.14 kernel
> I am currently running.
> I *think* I've uncovered a race condition bug in procfs.
> If I attempt to open a file in /proc/net, eg "/proc/net/tcp"
> it works fine, but if I spawn a POSIX thread and attempt to do it
> from there, it *usually* fails with a "No such file or directory",
> but some times succeeds. If I do a system call inside the thread
> to look up the thread ID and then open "/proc/THREADID/net/tcp"
> instead, it works fine.
> There are more details and some example code
> so you can replicate the problem on a stack overflow question
> I asked previously here:
> (*)


as was correctly notes on SO, what's happening is that original thread exits
before spawned thread does open().

nsproxy = NULL <== thread is dead

This was probably broken when /proc/net became symlink:

commit e9720acd728a46cb40daa52c99a979f7c4ff195c
Author: Pavel Emelyanov <xemul@xxxxxxxxxx>
Date: Fri Mar 7 11:08:40 2008 -0800

[NET]: Make /proc/net a symlink on /proc/self/net (v3)

So, userspace has two solutions:
1) original thread doesn't exit too early
2) spawned thread uses /proc/$TID

we definitely broke /proc/net/tcp somewhere after netns concept was introduced.

you'd have very same problem with other /proc files (anything under


#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdio.h>
#include <pthread.h>
#include <unistd.h>

void *f(void *_)
int fd;


fd = open("/proc/net/tcp", O_RDONLY);
if (fd == -1) {
fprintf(stderr, "FAIL\n");
return NULL;
fprintf(stderr, "OK\n");
return NULL;

int main(void)
pthread_t thread;

pthread_create(&thread, NULL, f, NULL);
return 0;
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at