[Bug libc/2683] New: dladdr() returns wrong symbol names in rare cases

[Bug libc/2683] New: dladdr() returns wrong symbol names in rare cases

[satoru at 0xcc dot net]

I think undefined symbols should be skipped while finding symbols from dynamic
symbol tables in _dl_addr() in elf/dl-addr.c.  Otherwise, it returns wrong
symbol names in rare cases.

Here is the code for reproducing the problem.  I tested it on Debian GNU/Linux
sarge on a x86_32 machine (glibc 2.3.2) but looked like the latest glibc in CVS
had the same problem.

% cat main.c
#include <stdio.h>
#define __USE_GNU 1
#include <dlfcn.h>
extern void foo();
static void dummy_func() {}
int main() {
    Dl_info info;
    void *p = &foo;
    dladdr(dummy_func, &info);
    if (info.dli_sname) {
        printf("%s\n", info.dli_sname);
    }
    return 0;
}

% cat foo.c
void foo() {
    volatile int a = 0;
    // Make this function big.
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
    ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a; ++a;
}

% gcc -shared -o foo.so foo.c
% gcc -rdynamic main.c ./foo.so -ldl
% ./a.out
foo

Here, "foo" shouldn't be printed.

% readelf --symbols a.out | egrep 'foo|dummy_func'
    13: 080484d8   505 FUNC    GLOBAL DEFAULT  UND foo
    83: 08048594     5 FUNC    LOCAL  DEFAULT   12 dummy_func
   104: 080484d8   505 FUNC    GLOBAL DEFAULT  UND foo

"foo" was picked since the following condition satisfied.

  0x080484d8 (foo) <= 0x08048594 (dummmy_func) < 0x80486d1 (0x080484d8 + 505)


I haven't tested but I guess the following patch would solve the problem.

% diff -u elf/dl-addr.c.orig elf/dl-addr.c
--- elf/dl-addr.c.orig  2006-05-22 23:16:21.000000000 +0900
+++ elf/dl-addr.c       2006-05-22 23:16:42.000000000 +0900
@@ -92,6 +92,7 @@
 #if defined USE_TLS
            && ELFW(ST_TYPE) (symtab->st_info) != STT_TLS
 #endif
+            && symtab->st_shndx != SHN_UNDEF
            && DL_ADDR_SYM_MATCH (match, symtab, matchsym, addr)
            && symtab->st_name < strtabsize)
          matchsym = (ElfW(Sym) *) symtab;

-- 
           Summary: dladdr() returns wrong symbol names in rare cases
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: satoru at 0xcc dot net
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=2683

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2683] dladdr() returns wrong symbol names in rare cases

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2006-05-24 19:25 -------
Correct patch, I applied it to CVS.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=2683

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2683] dladdr() returns wrong symbol names in rare cases

[satoru at 0xcc dot net]

------- Additional Comments From satoru at 0xcc dot net  2006-05-28 05:04 -------
(In reply to comment #1)
> Correct patch, I applied it to CVS.

Thank you for fixing the bug.

I just realized that completly skipping undefined references
could be a problem.  Consider the following code.

  #include <stdio.h>
  int main() {
      printf("%p\n", &printf);
      return 0;
  }

If I compile it without -fPIC on my machine (Debian GNU/Linux sarge on a x86_32
machine), 
&printf points to a memory address in PLT.

  % gcc test.c
  % ./a.out
  0x8048288

  % readelf -S a.out  |grep " \.plt"
  [11] .plt          PROGBITS        08048270 000270 000030 04  AX  0   0  4

The binary contains the undefined symbols for printf both in
.dysym and .symtab sections and the values of the undefined symbols
correspond to the memory address in PLT (0x8048288).

  % readelf --symbols a.out |grep printf
   2: 08048288    57 FUNC    GLOBAL DEFAULT  UND printf@GLIBC_2.0 (2)
  99: 08048288    57 FUNC    GLOBAL DEFAULT  UND printf@@GLIBC_2.0

Hence, to support dladdr(&printf, info) for non-pic binaries,
probably we need to allow the condition something like this as well.

  (ELFW(ST_TYPE) (symtab->st_info) == STT_FUNC
   && symtab->st_shndx == SHN_UNDEF
   && match->l_addr + symtab->st_value == addr)


On the other hand, if I compile the same code with -fPIC,
&printf points to the printf definition in the map of glibc.
There is no problem in this case for doing dladdr(&printf, info).

  % gcc -fPIC test.c
  % ./a.out
  0x4006e8e0

  % ldd a.out
        libc.so.6 => /lib/libc.so.6 (0x4001f000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)
  % readelf --symbols /lib/libc.so.6|grep " printf"
   157: 0004f8e0    57 FUNC    GLOBAL DEFAULT   11       printf@@GLIBC_2.0

  % python
  >>> "%x" % (0x4001f000 + 0x0004f8e0)
  '4006e8e0'


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |


http://sourceware.org/bugzilla/show_bug.cgi?id=2683

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/2683] dladdr() returns wrong symbol names in rare cases

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2006-08-24 20:20 -------
I adjusted the patch.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|                            |FIXED


http://sourceware.org/bugzilla/show_bug.cgi?id=2683

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.