[Bug dynamic-link/26076] New: dlclose crashes when cleaning up an empty namespace after dlmopen failure

[Bug dynamic-link/26076] New: dlclose crashes when cleaning up an empty namespace after dlmopen failure

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26076

            Bug ID: 26076
           Summary: dlclose crashes when cleaning up an empty namespace
                    after dlmopen failure
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: minor
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
             Flags: security-

If nothing has been loaded, ns->_ns_loaded is NULL and head->l_auditing
attempts to dereference a NULL pointer:

#ifdef SHARED
  /* Auditing checkpoint: we have deleted all objects.  */
  if (__glibc_unlikely (do_audit))
    {
      struct link_map *head = ns->_ns_loaded;
      /* Do not call the functions for any auditing object.  */
      if (head->l_auditing == 0)
        {
          struct audit_ifaces *afct = GLRO(dl_audit);
          for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
            {
              if (afct->activity != NULL)
                {
                  struct auditstate *state = link_map_audit_state (head, cnt);
                  afct->activity (&state->cookie, LA_ACT_CONSISTENT);
                }

              afct = afct->next;
            }
        }
    }
#endif

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26076] dlmopen crashes when cleaning up an empty namespace in audit mode

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26076

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
            Summary|dlclose crashes when        |dlmopen crashes when
                   |cleaning up an empty        |cleaning up an empty
                   |namespace after dlmopen     |namespace in audit mode
                   |failure                     |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26076] dlmopen crashes after failing to load dependencies in audit mode

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26076

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |fweimer at redhat dot com
             Status|NEW                         |ASSIGNED
            Summary|dlmopen crashes when        |dlmopen crashes after
                   |cleaning up an empty        |failing to load
                   |namespace in audit mode     |dependencies in audit mode

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
The cause is slightly different: If dlmopen fails late (in _dl_map_object_deps,
not _dl_map_object), we need to dlclose the initially opened module, and that
crashes in audit mode.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26076] dlmopen crashes after failing to load dependencies in audit mode

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26076

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |NEW
           Assignee|fweimer at redhat dot com          |unassigned at sourceware dot org

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
Work has stalled because we probably should rework how namespaces for audit
modules are marked:

https://sourceware.org/pipermail/libc-alpha/2020-June/114771.html

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26076] dlmopen crashes after failing to load dependencies in audit mode

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26076

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
   Target Milestone|---                         |2.32
         Resolution|---                         |FIXED

--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for glibc 2.32 with:

commit 3ad5dab476205d6e16156cf0511fa6884b3b0fc4
Author: Florian Weimer <fweimer@redhat.com>
Date:   Tue Jul 7 09:58:45 2020 +0200

    elf: Do not signal LA_ACT_CONSISTENT for an empty namespace [BZ #26076]

    The auditing interface identifies namespaces by their first loaded
    module.  Once the namespace is empty, it is no longer possible to signal
    LA_ACT_CONSISTENT for it because the first loaded module is already gone
    at that point.

    Reviewed-by: Carlos O'Donell <carlos@redhat.com>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26076] dlmopen crashes after failing to load dependencies in audit mode

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=26076

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |fweimer at redhat dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.