[Bug nptl/12416] New: Dynamic linker incorrectly reduces the stack size when making it executable

["kumpera at gmail dot com" <sourceware-bugzilla@sourceware.org>]

http://sourceware.org/bugzilla/show_bug.cgi?id=12416

           Summary: Dynamic linker incorrectly reduces the stack size when
                    making it executable
           Product: glibc
           Version: 2.11
            Status: NEW
          Severity: normal
          Priority: P2
         Component: nptl
        AssignedTo: drepper.fsp@gmail.com
        ReportedBy: kumpera@gmail.com


If one dlopen a DSO that is not annotated with non executable stack, the
dynamic linker will have to make all stacks executables and when doing so for
the main thread it sometimes unmap a few pages from the botton of the stack.

This is on amd64 linux with kernel 2.6.34.7 and glibc 2.11.2.

Using the following program one can notice this happening:

#include <stdio.h>
#include <dlfcn.h>
#include <string.h>

size_t proc_self () {
    FILE *proc = fopen ("/proc/self/maps", "r");
    char *l = NULL;
    size_t size, stack_ptr;
    stack_ptr = (size_t)&size;
    while (getline (&l, &size, proc) != -1) {
        size_t start, end;
        sscanf (l, "%lx-%lx", &start, &end);
        if (strstr (l, "[stack]")){
            printf ("found stack: %s", l);
            return end;
        }
    }
    return 0;

}

void main (int argc, char *argv[]) {
    size_t r = proc_self ();
    void *handle = dlopen (argc [1], RTLD_LAZY);
    printf ("handle is %p\n", handle);
    size_t r2 = proc_self ();

    if (r != r2)
        printf ("KILLED %lx bytes\n", r - r2);
}



To see this behavior any DSO with execstack set must be used.
The output will be something like:

found stack: 7fff831a9000-7fff831ca000 rw-p 00000000 00:00 0                   
      [stack]
found stack: 7fff831a9000-7fff831c9000 rwxp 00000000 00:00 0                   
      [stack]
KILLED 1000 bytes


As you can see a one page has been unmapped from the bottom of the stack and
this does affect programs that expect the stack bounds to be sane. This makes
pthread_getattr_np return value be unreliable in face of dynamic loading.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.