[Bug dynamic-link/15022] New: Global-scope dlopen issues in static executables

[Bug dynamic-link/15022] New: Global-scope dlopen issues in static executables

[macro@linux-mips.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15022

             Bug #: 15022
           Summary: Global-scope dlopen issues in static executables
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
        AssignedTo: unassigned@sourceware.org
        ReportedBy: macro@linux-mips.org
    Classification: Unclassified


We have two issues with dlopen [1] issued from static executables when
the global scope is accessed.

 First, an attempt to add a dynamic shared module to the global scope 
(i.e. with RTLD_GLOBAL requested) crashes like this:

Program received signal SIGSEGV, Segmentation fault.
add_to_global (new=0x49ef60) at dl-open.c:101
101           ns->_ns_global_scope_alloc

This is because at this point in static executables no global search list 
data structure has been initialised and as result the _ns_main_searchlist 
member of _dl_ns[LM_ID_BASE] (the initial namespace) is null.

 Second, an attempt to access the global scope itself (i.e. by using a 
null file name pointer) fails with an obscure error like:

/path/to/dir/: cannot read file data: Is a directory

(that can be retrieved with dlerror), where /path/to/dir/ is the first 
directory searched according to the dynamic load engine's shared module 
lookup policy.  This is because the null file name pointer is internally 
converted to an empty string, that is in turn looked for and then opened 
in the directories examined.  Of course that succeeds -- the directory 
itself is opened, but then the engine gets confused by the outcome and 
bails out.  The use of an empty string works in dynamic executables, 
because for them the dynamic loader has already prepared a link map 
referring to a file whose name is empty -- which, by means of how that 
code works, is the executable itself -- and that makes the loader abandon 
any file look-ups and use the link map already present.

 The two issues both boil down to the same bug -- no global scope present.

 Patch offered: http://sourceware.org/ml/libc-alpha/2013-01/msg00635.html

[1] http://pubs.opengroup.org/onlinepubs/7908799/xsh/dlopen.html

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/15022] Global-scope dlopen issues in static executables

[macro@linux-mips.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15022

Maciej W. Rozycki <macro@linux-mips.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED
           Assignee|unassigned at sourceware dot org   |macro@linux-mips.org

--- Comment #1 from Maciej W. Rozycki <macro@linux-mips.org> ---
commit f91f1c0fb89056995f1c9c6a06c361efdf5139e7
Author: Maciej W. Rozycki <macro@codesourcery.com>
Date:   Fri Jun 28 16:20:26 2013 +0100

    [BZ #15022] Correct global-scope dlopen issues in static executables.

    This change creates a link map in static executables to serve as the
    global search list for dlopen.  It fixes a problem with the inability
    to access the global symbol object and a crash on an attempt to map a
    DSO into the global scope.  Some code that has become dead after the
    addition of this link map is removed too and test cases are provided.

2013-06-28  Maciej W. Rozycki  <macro@codesourcery.com>

    [BZ #15022]
    * elf/dl-support.c (_dl_main_map): New variable.
    (_dl_ns): Use it to initialize [LM_ID_BASE] element.
    (_dl_nns, _dl_load_adds): Set to 1.
    (_dl_initial_searchlist): Refer to _dl_main_map.
    (_dl_non_dynamic_init): Initialize _dl_main_map.l_origin.
    * elf/dl-load.c (_dl_dst_substitute) [!SHARED]: Remove fallback
    call to _dl_get_origin.
    * elf/dl-open.c (dl_open_worker): Remove !SHARED special casing
    around call_map.
    (_dl_open) [!SHARED]: Remove code to initialize GL(dl_nns).
    * dlfcn/modstatic3.c: New file.
    * dlfcn/tststatic3.c: New file.
    * dlfcn/tststatic4.c: New file.
    * dlfcn/Makefile (tests): Add tststatic3 and tststatic4.
    (tests-static): Likewise.
    (modules-names): Add modstatic3.
    (tststatic3-ENV, tststatic4-ENV): New variables.
    ($(objpfx)tststatic3, $(objpfx)tststatic3.out): New dependencies.
    ($(objpfx)tststatic4, $(objpfx)tststatic4.out): Likewise.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/15022] Global-scope dlopen issues in static executables

[cvs-commit at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=15022

--- Comment #2 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  0d23a5c1b1908700d25b7e3c6cece148e19dded4 (commit)
      from  0037bb6010522e20dde2da7922071d5cb53f67eb (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=0d23a5c1b1908700d25b7e3c6cece148e19dded4

commit 0d23a5c1b1908700d25b7e3c6cece148e19dded4
Author: Maciej W. Rozycki <macro@codesourcery.com>
Date:   Fri Jan 31 17:51:31 2014 +0000

    [BZ #16046] Static dlopen correction fallout fixes.

    Fixes to address issues from BZ #15022 resolution, as follows:

    * TLS updates to csu/libc-tls.c -- we now have a proper main map, so
      there's no longer a need to create a separate fake one to keep TLS
      structures,

    * random updates to elf/dl-close.c -- LM_ID_BASE is now a valid name
      space ID for static executables as well, so assert that we don't
      unload the main map.  Similarly dl_nns isn't supposed to be 0 for
      static executables anymore,

    * actual BZ #16046 fix to elf/dl-iteratephdr.c -- the dl_iterate_phdr
      special function for static executables isn't needed anymore, provided
      that l_phdr and l_phnum members of the main map have been properly
      initialized (done in _dl_non_dynamic_init in elf/dl-support.c now),

    * ld.so.cache loader update to elf/dl-load.c --
      GL(dl_ns)[LM_ID_BASE]._ns_loaded is now always initialized in static
      executables so can become the fallback loader map to check for
      DF_1_NODEFLIB, provided that the l_flags_1 member of the main map has
      been properly initialized (done in elf/dl-support.c now); this also
      ensures previous semantics elsewhere in elf/dl-load.c,

    * matching updates to elf/dl-support.c -- to complement the two fixes
      above.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog            |   16 ++++++++++++++++
 NEWS                 |   14 +++++++-------
 csu/libc-tls.c       |   27 ++++++++++++---------------
 elf/dl-close.c       |   10 +---------
 elf/dl-iteratephdr.c |   30 ------------------------------
 elf/dl-load.c        |   14 ++++----------
 elf/dl-support.c     |    3 +++
 7 files changed, 43 insertions(+), 71 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/15022] Global-scope dlopen issues in static executables

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=15022

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.