[Bug dynamic-link/16272] New: dlopen()ing a DT_FILTER library crashes if filtee has constructor

classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

[Bug dynamic-link/16272] New: dlopen()ing a DT_FILTER library crashes if filtee has constructor

glaubitz at physik dot fu-berlin.de
https://sourceware.org/bugzilla/show_bug.cgi?id=16272

            Bug ID: 16272
           Summary: dlopen()ing a DT_FILTER library crashes if filtee has
                    constructor
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: brnguyen at nvidia dot com

Created attachment 7309
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7309&action=edit
Reproduction test case

The attached test case loads a DSO which has a DT_FILTER set to a shared
object with a constructor function.  This segfaults on RHEL 6.4, and on an
ld.so built from commit a9503496671bb22278bd1203182066f0bb28239a, this
crashes with the following assertion:

Inconsistency detected by ld.so: dl-deps.c: 586: _dl_map_object_deps:
Assertion `map->l_searchlist.r_list[0] == map' failed!

This also reproduces if I replace "--Wl,--filter=libtest.so.1" with
"--Wl,--auxiliary=libtest.so.1" in the Makefile.

--
You are receiving this mail because:
You are on the CC list for the bug.
Reply | Threaded
Open this post in threaded view
|

[Bug dynamic-link/16272] dlopen()ing a DT_FILTER library crashes if filtee has constructor

glaubitz at physik dot fu-berlin.de
https://sourceware.org/bugzilla/show_bug.cgi?id=16272

Brian Nguyen <brnguyen at nvidia dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |brnguyen at nvidia dot com

--
You are receiving this mail because:
You are on the CC list for the bug.
Reply | Threaded
Open this post in threaded view
|

[Bug dynamic-link/16272] dlopen()ing a DT_FILTER library crashes if filtee has constructor

glaubitz at physik dot fu-berlin.de
In reply to this post by glaubitz at physik dot fu-berlin.de
https://sourceware.org/bugzilla/show_bug.cgi?id=16272

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

--
You are receiving this mail because:
You are on the CC list for the bug.
Reply | Threaded
Open this post in threaded view
|

[Bug dynamic-link/16272] dlopen()ing a DT_FILTER library crashes if filtee has constructor

glaubitz at physik dot fu-berlin.de
In reply to this post by glaubitz at physik dot fu-berlin.de
https://sourceware.org/bugzilla/show_bug.cgi?id=16272

Arthur Huillet <arthur.huillet+sourcewarebz at free dot fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |arthur.huillet+sourcewarebz
                   |                            |@free.fr

--
You are receiving this mail because:
You are on the CC list for the bug.
Reply | Threaded
Open this post in threaded view
|

[Bug dynamic-link/16272] dlopen()ing a DT_FILTER library crashes if filtee has constructor

glaubitz at physik dot fu-berlin.de
In reply to this post by glaubitz at physik dot fu-berlin.de
https://sourceware.org/bugzilla/show_bug.cgi?id=16272

--- Comment #1 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Adhemerval Zanella
<[hidden email]>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb447b7b4bd6177f876ba9420ad9e048c27bae91

commit eb447b7b4bd6177f876ba9420ad9e048c27bae91
Author: David Kilroy <[hidden email]>
Date:   Wed Feb 12 14:28:15 2020 -0300

    elf: Allow dlopen of filter object to work [BZ #16272]

    There are two fixes that are needed to be able to dlopen filter
    objects. First _dl_map_object_deps cannot assume that map will be at
    the beginning of l_searchlist.r_list[], as filtees are inserted before
    map. Secondly dl_open_worker needs to ensure that filtees get
    relocated.

    In _dl_map_object_deps:

    * avoiding removing relocation dependencies of map by setting
      l_reserved to 0 and otherwise processing the rest of the search
      list.

    * ensure that map remains at the beginning of l_initfini - the list
      of things that need initialisation (and destruction). Do this by
      splitting the copy up. This may not be required, but matches the
      initialization order without dlopen.

    Modify dl_open_worker to relocate the objects in new->l_inifini.
    new->l_initfini is constructed in _dl_map_object_deps, and lists the
    objects that need initialization and destruction. Originally the list
    of objects in new->l_next are relocated. All of these objects should
    also be included in new->l_initfini (both lists are populated with
    dependencies in _dl_map_object_deps). We can't use new->l_prev to pick
    up filtees, as during a recursive dlopen from an interposed malloc
    call, l->prev can contain objects that are not ready for relocation.

    Add tests to verify that symbols resolve to the filtee implementation
    when auxiliary and filter objects are used, both as a normal link and
    when dlopen'd.

    Tested by running the testsuite on x86_64.

--
You are receiving this mail because:
You are on the CC list for the bug.
Reply | Threaded
Open this post in threaded view
|

[Bug dynamic-link/16272] dlopen()ing a DT_FILTER library crashes if filtee has constructor

glaubitz at physik dot fu-berlin.de
In reply to this post by glaubitz at physik dot fu-berlin.de
https://sourceware.org/bugzilla/show_bug.cgi?id=16272

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg
         Resolution|---                         |FIXED

--- Comment #2 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
Fixed on 2.32.

--
You are receiving this mail because:
You are on the CC list for the bug.
Reply | Threaded
Open this post in threaded view
|

[Bug dynamic-link/16272] dlopen()ing a DT_FILTER library crashes if filtee has constructor

Sourceware - glibc-bugs mailing list
In reply to this post by glaubitz at physik dot fu-berlin.de
https://sourceware.org/bugzilla/show_bug.cgi?id=16272

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.32

--
You are receiving this mail because:
You are on the CC list for the bug.