d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

If dlopen() is called for the dso that has been already loaded as a

Browse Source 
dependency, then the dso never has its DAG initialized. Empty DAG
makes ref_dag() call in dlopen() a nop, and the dso refcount is off
by one.

Initialize the DAG on the first dlopen() call, using a boolean flag
to prevent double initialization.

From the PR (edited):
Assume we have a library liba.so, containing a function a(), and a
library libb.so, containing function b(). liba.so needs functionality
from libb.so, so liba.so links in libb.so.

An application doesn't know about the relation between these libraries,
but needs to call a() and b(). It dlopen()s liba.so and obtains a
pointer to a(), then it dlopen()s libb.so and obtains a pointer to b().

As soon as the application doesn't need a() anymore, it dlclose()s liba.so.

Expected result: the pointer to b() is still valid and can be called
Actual result: the pointer to b() has become invalid, even though the
application did not dlclose() the handle to libb.so. On calling b(), the
application crashes with a segmentation fault.

PR:	misc/151861
Based on patch by:	jh
Reviewed by:	kan
Tested by:	Arjan van Leeuwen <freebsd-maintainer opera com>
MFC after:	1 week
This commit is contained in:
kib 2010-11-03 09:23:08 +00:00
parent d83519c991
commit 6ddde2168b
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libexec/rtld-elf/rtld.c
View File

@ -1275,8 +1275,11 @@ init_dag(Obj_Entry *root)
{ {
DoneList donelist; DoneList donelist;
if (root->dag_inited)
return;
donelist_init(&donelist); donelist_init(&donelist);
init_dag1(root, root, &donelist); init_dag1(root, root, &donelist);
root->dag_inited = true;
} }
static void static void
@ -2045,8 +2048,16 @@ dlopen(const char *name, int mode)
} }
} else { } else {
/* Bump the reference counts for objects on this DAG. */ /*
ref_dag(obj); * Bump the reference counts for objects on this DAG. If
* this is the first dlopen() call for the object that was
* already loaded as a dependency, initialize the dag
* starting at it.
*/
if (obj->dl_refcount == 1)
init_dag(obj);
else
ref_dag(obj);
if (ld_tracing) if (ld_tracing)
goto trace; goto trace;

1
libexec/rtld-elf/rtld.h
View File

@ -222,6 +222,7 @@ typedef struct Struct_Obj_Entry {
bool ref_nodel : 1; /* Refcount increased to prevent dlclose */ bool ref_nodel : 1; /* Refcount increased to prevent dlclose */
bool init_scanned: 1; /* Object is already on init list. */ bool init_scanned: 1; /* Object is already on init list. */
bool on_fini_list: 1; /* Object is already on fini list. */ bool on_fini_list: 1; /* Object is already on fini list. */
bool dag_inited : 1; /* Object has its DAG initialized. */
struct link_map linkmap; /* For GDB and dlinfo() */ struct link_map linkmap; /* For GDB and dlinfo() */
Objlist dldags; /* Object belongs to these dlopened DAGs (%) */ Objlist dldags; /* Object belongs to these dlopened DAGs (%) */