aboutsummaryrefslogtreecommitdiff
path: root/elf
diff options
context:
space:
mode:
authorCarlos O'Donell <carlos@systemhalted.org>2015-01-21 01:51:10 -0500
committerCarlos O'Donell <carlos@systemhalted.org>2015-01-21 01:51:10 -0500
commitccdb048df457d581f6ac7ede8b0c7a593a891dfa (patch)
tree9f87447c45093fb2ded95c982e68c9e6e886129c /elf
parent042e1521c794a945edc43b5bfa7e69ad70420524 (diff)
downloadglibc-ccdb048df457d581f6ac7ede8b0c7a593a891dfa.tar
glibc-ccdb048df457d581f6ac7ede8b0c7a593a891dfa.tar.gz
glibc-ccdb048df457d581f6ac7ede8b0c7a593a891dfa.tar.bz2
glibc-ccdb048df457d581f6ac7ede8b0c7a593a891dfa.zip
Fix recursive dlopen.
The ability to recursively call dlopen is useful for malloc implementations that wish to load other dynamic modules that implement reentrant/AS-safe functions to use in their own implementation. Given that a user malloc implementation may be called by an ongoing dlopen to allocate memory the user malloc implementation interrupts dlopen and if it calls dlopen again that's a reentrant call. This patch fixes the issues with the ld.so.cache mapping and the _r_debug assertion which prevent this from working as expected. See: https://sourceware.org/ml/libc-alpha/2014-12/msg00446.html
Diffstat (limited to 'elf')
-rw-r--r--elf/dl-cache.c21
-rw-r--r--elf/dl-load.c14
-rw-r--r--elf/dl-open.c4
3 files changed, 25 insertions, 14 deletions
diff --git a/elf/dl-cache.c b/elf/dl-cache.c
index 80d5e300f0..dec49bc0f2 100644
--- a/elf/dl-cache.c
+++ b/elf/dl-cache.c
@@ -174,9 +174,12 @@ _dl_cache_libcmp (const char *p1, const char *p2)
/* Look up NAME in ld.so.cache and return the file name stored there, or null
if none is found. The cache is loaded if it was not already. If loading
- the cache previously failed there will be no more attempts to load it. */
-
-const char *
+ the cache previously failed there will be no more attempts to load it.
+ The caller is responsible for freeing the returned string. The ld.so.cache
+ may be unmapped at any time by a completing recursive dlopen and
+ this function must take care that it does not return references to
+ any data in the mapping. */
+char *
internal_function
_dl_load_cache_lookup (const char *name)
{
@@ -289,7 +292,17 @@ _dl_load_cache_lookup (const char *name)
&& best != NULL)
_dl_debug_printf (" trying file=%s\n", best);
- return best;
+ if (best == NULL)
+ return NULL;
+
+ /* The double copy is *required* since malloc may be interposed
+ and call dlopen itself whose completion would unmap the data
+ we are accessing. Therefore we must make the copy of the
+ mapping data without using malloc. */
+ char *temp;
+ temp = alloca (strlen (best) + 1);
+ strcpy (temp, best);
+ return strdup (temp);
}
#ifndef MAP_COPY
diff --git a/elf/dl-load.c b/elf/dl-load.c
index d6726b627f..73174aa424 100644
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -2051,7 +2051,7 @@ _dl_map_object (struct link_map *loader, const char *name,
{
/* Check the list of libraries in the file /etc/ld.so.cache,
for compatibility with Linux's ldconfig program. */
- const char *cached = _dl_load_cache_lookup (name);
+ char *cached = _dl_load_cache_lookup (name);
if (cached != NULL)
{
@@ -2075,6 +2075,7 @@ _dl_map_object (struct link_map *loader, const char *name,
if (memcmp (cached, dirp, system_dirs_len[cnt]) == 0)
{
/* The prefix matches. Don't use the entry. */
+ free (cached);
cached = NULL;
break;
}
@@ -2092,14 +2093,9 @@ _dl_map_object (struct link_map *loader, const char *name,
LA_SER_CONFIG, mode, &found_other_class,
false);
if (__glibc_likely (fd != -1))
- {
- realname = __strdup (cached);
- if (realname == NULL)
- {
- __close (fd);
- fd = -1;
- }
- }
+ realname = cached;
+ else
+ free (cached);
}
}
}
diff --git a/elf/dl-open.c b/elf/dl-open.c
index c358fff900..47b4cb500a 100644
--- a/elf/dl-open.c
+++ b/elf/dl-open.c
@@ -217,7 +217,9 @@ dl_open_worker (void *a)
args->nsid = call_map->l_ns;
}
- assert (_dl_debug_initialize (0, args->nsid)->r_state == RT_CONSISTENT);
+ /* One might be tempted to assert that we are RT_CONSISTENT at this point, but that
+ may not be true if this is a recursive call to dlopen. */
+ _dl_debug_initialize (0, args->nsid);
/* Load the named object. */
struct link_map *new;