public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug nptl/12416] New: Dynamic linker incorrectly reduces the stack size when making it executable
@ 2011-01-19 18:29 kumpera at gmail dot com
  2011-01-19 18:53 ` [Bug nptl/12416] " drepper.fsp at gmail dot com
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: kumpera at gmail dot com @ 2011-01-19 18:29 UTC (permalink / raw)
  To: glibc-bugs

http://sourceware.org/bugzilla/show_bug.cgi?id=12416

           Summary: Dynamic linker incorrectly reduces the stack size when
                    making it executable
           Product: glibc
           Version: 2.11
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: kumpera@gmail.com


If one dlopen a DSO that is not annotated with non executable stack, the
dynamic linker will have to make all stacks executables and when doing so for
the main thread it sometimes unmap a few pages from the botton of the stack.

This is on amd64 linux with kernel 2.6.34.7 and glibc 2.11.2.

Using the following program one can notice this happening:

#include <stdio.h>
#include <dlfcn.h>
#include <string.h>

size_t proc_self () {
    FILE *proc = fopen ("/proc/self/maps", "r");
    char *l = NULL;
    size_t size, stack_ptr;
    stack_ptr = (size_t)&size;
    while (getline (&l, &size, proc) != -1) {
        size_t start, end;
        sscanf (l, "%lx-%lx", &start, &end);
        if (strstr (l, "[stack]")){
            printf ("found stack: %s", l);
            return end;
        }
    }
    return 0;

}

void main (int argc, char *argv[]) {
    size_t r = proc_self ();
    void *handle = dlopen (argc [1], RTLD_LAZY);
    printf ("handle is %p\n", handle);
    size_t r2 = proc_self ();

    if (r != r2)
        printf ("KILLED %lx bytes\n", r - r2);
}



To see this behavior any DSO with execstack set must be used.
The output will be something like:

found stack: 7fff831a9000-7fff831ca000 rw-p 00000000 00:00 0                   
      [stack]
found stack: 7fff831a9000-7fff831c9000 rwxp 00000000 00:00 0                   
      [stack]
KILLED 1000 bytes


As you can see a one page has been unmapped from the bottom of the stack and
this does affect programs that expect the stack bounds to be sane. This makes
pthread_getattr_np return value be unreliable in face of dynamic loading.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2014-06-27 14:03 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2011-01-19 18:29 [Bug nptl/12416] New: Dynamic linker incorrectly reduces the stack size when making it executable kumpera at gmail dot com
2011-01-19 18:53 ` [Bug nptl/12416] " drepper.fsp at gmail dot com
2011-01-19 19:25 ` roland at gnu dot org
2011-01-19 20:35 ` kumpera at gmail dot com
2012-05-26  4:32 ` siddhesh at redhat dot com
2012-05-26 15:31 ` kumpera at gmail dot com
2012-05-28  5:27 ` siddhesh at redhat dot com
2012-10-03 18:18 ` siddhesh at redhat dot com
2014-06-27 14:03 ` fweimer at redhat dot com

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).