Thread local storage does not work using threads created with clone() - linux

Question

The program below creates ten threads using Linux's clone() system call. The static variable tls has the C11 thread_local attribute. The threads execute the child_func function, which just increments the tls variable and stores the incremented value in the location pointed to by the argument arg. The incremented values are stored, one for each thread, in the array tlsvals. The main function waits for the threads to finish and then prints the values of the ten instances of the tls variable. (I have skipped error checking and the freeing of the allocated stacks in this version of the code, to keep the example brief.)
#define _GNU_SOURCE
#include <sched.h>
#include <sys/wait.h>
#include <stdio.h>
#include <stdlib.h>
#include <threads.h> /* For thread_local. */
#define NTHREADS 10
static thread_local int tls = 0;
static int child_func(void *arg)
{
tls++;
*((int *)arg) = tls;
return 0;
}
int main(int argc, char** argv)
{
int tlsvals[NTHREADS];
for (int n = 0; n < NTHREADS; n++) {
const int STACK_SIZE = 65536;
if (clone(child_func, malloc(STACK_SIZE) + STACK_SIZE, CLONE_VM | SIGCHLD, tlsvals+n) == -1) {
perror("clone");
exit(1);
}
}
int ret, status;
while ((ret = wait(&status)) != -1)
;
for (int *p = tlsvals; p < tlsvals + NTHREADS; p++)
printf("The value of tls is %d\n", *p);
return 0;
}
Since the tls variable is marked thread_local, I expected the program to print ten lines of The value of tls is 1, since each thread increments the variable once from its initial zero value. Instead I get the following output:
The value of tls is 1
The value of tls is 3
The value of tls is 2
The value of tls is 4
The value of tls is 5
The value of tls is 6
The value of tls is 7
The value of tls is 8
The value of tls is 9
The value of tls is 10
So it seems the tls variable is not thread-local at all, but shared by all the threads, and each thread increments the same variable.
The code was compiled with GCC version 9.1.0 on x86_64 using the following command line:
gcc -O2 -Wall -std=c11 tfoo.c -o tfooc
I also tried using the GCC specific __thread attribute instead of thread_local, with the same result.
Looking at the assembly produced by GCC, I can see that the variable is accessed via the %fs register, as it should be:
child_func:
.LFB24:
.cfi_startproc
movl %fs:tls#tpoff, %eax
addl $1, %eax
movl %eax, %fs:tls#tpoff
movl %eax, (%rdi)
xorl %eax, %eax
ret
.cfi_endproc
What am I doing wrong, or is there a bug in the implementation of thread_local in Gcc?