[Bug malloc/25533] dlopen with RTLD_DEEPBIND crashes when using custom memory manager

[Bug malloc/25533] dlopen with RTLD_DEEPBIND crashes when using custom memory manager

[Simon.Richter at hogyros dot de]

https://sourceware.org/bugzilla/show_bug.cgi?id=25533

Simon Richter <Simon.Richter at hogyros dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |Simon.Richter at hogyros dot de

--- Comment #5 from Simon Richter <Simon.Richter at hogyros dot de> ---
I have the same issue with a program that uses libtbbmalloc (overriding
malloc/realloc/free) and calls dlopen("libudev.so.1", RTLD_DEEPBIND).

This creates a situation where libudev is linked against glibc only and doesn't
see the overridden allocator, but the glibc instance it is linked to does have
these symbols overridden.

The crash happens when libudev calls strdup() from glibc, which allocates
memory from TBBmalloc, and later tries to pass the pointer to glibc's realloc()
function.

As far as I can see, this cannot be worked around other than by inhibiting
RTLD_DEEPBIND (which is what I do in a preload library).

The proper fix here would be to create another instance of glibc for use by the
hierarchy below the RTLD_DEEPBIND.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/25533] dlopen with RTLD_DEEPBIND crashes when using custom memory manager

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25533

--- Comment #6 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Simon Richter from comment #5)
> The proper fix here would be to create another instance of glibc for use by
> the hierarchy below the RTLD_DEEPBIND.

This will only push the problem one layer further, in the sense that the caller
of strdup would have to be duplicated as well. At that point, things start to
look a lot more like dlmopen rather than RTLD_DEEPBIND. However even with
dlmopen, separate mallocs may not be what users of this feature expect.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/25533] dlopen with RTLD_DEEPBIND crashes when using custom memory manager

[Simon.Richter at hogyros dot de]

https://sourceware.org/bugzilla/show_bug.cgi?id=25533

--- Comment #7 from Simon Richter <Simon.Richter at hogyros dot de> ---
> This will only push the problem one layer further, in the sense that the caller of strdup would have to be duplicated as well.

In my case, the caller of the strdup is the object that was loaded with
RTLD_DEEPBIND, so that would be kind of what I'd expect here: if another copy
of libudev already exists in the process and is reused without making sure that
its internal references aren't overridden in the instance that is returned,
then the RTLD_DEEPBIND would be silently ignored.

Rereading the documentation of RTLD_DEEPBIND, I'm even slightly confused why
applying RTLD_DEEPBIND to an object will also pull the symbols of its
dependencies to the front (so glibc's "realloc" wins over libtbbmalloc's, as
libudev is only linked against glibc). I would have expected libudev's symbols
to take precedence for internal resolution, and then the same order as in the
rest of the program for the other symbols.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/25533] dlopen with RTLD_DEEPBIND crashes when using custom memory manager

[parky at outlook dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25533

Matthew Parkinson <parky at outlook dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |parky at outlook dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/25533] dlopen with RTLD_DEEPBIND crashes when using custom memory manager

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=25533

--- Comment #8 from Florian Weimer <fweimer at redhat dot com> ---
(In reply to Simon Richter from comment #7)
> Rereading the documentation of RTLD_DEEPBIND, I'm even slightly confused why
> applying RTLD_DEEPBIND to an object will also pull the symbols of its
> dependencies to the front (so glibc's "realloc" wins over libtbbmalloc's, as
> libudev is only linked against glibc). I would have expected libudev's
> symbols to take precedence for internal resolution, and then the same order
> as in the rest of the program for the other symbols.

We discussed this during today's patch review call. The issue here is that some
(many?) uses of RTLD_DEEPBIND depend on this altered symbol resolution
behavior: the newly loaded object is supposed to bind against the symbols of
its dependencies as if there was nothing else in the process image, to avoid
unwanted preemption. In some cases, this is even done to prevent preemption
coming from LD_PRELOAD. For malloc, this is pretty much never going to work,
but it might be exactly what's needed for other libc symbols. It's hard to tell
where to draw the line.

-- 
You are receiving this mail because:
You are on the CC list for the bug.