[Bug dynamic-link/29600] New: dlmopen hangs after loading certain libraries

[Bug dynamic-link/29600] New: dlmopen hangs after loading certain libraries

[al_95 at outlook dot it]

https://sourceware.org/bugzilla/show_bug.cgi?id=29600

            Bug ID: 29600
           Summary: dlmopen hangs after loading certain libraries
           Product: glibc
           Version: 2.36
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: al_95 at outlook dot it
  Target Milestone: ---

Created attachment 14351
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14351&action=edit
dlmopen test

Hi.
I discovered a regression bug in dlmopen introduced with the fix to bug 29528.
Certain libraries seem to leave the dynamic loader namespaces in an
inconsistent state, causing all subsequent dlmopen calls to hang.
The hang happens at the for loop inside the _dl_debug_initialize function in
dl-open.c, when it iterates through the namespaces linked list.

This issue happens only after loading certain libraries, but not others.
I attached a small program that exhibits this issue on my pc.
After libcurl is loaded (and unloaded) any following call to dlmopen will
freeze.
Moving the order around doesn't change much, except when libcurl is loaded
first, then somehow everything works.
A few other libraries I tested that cause this behavior are libstdc++,
libavcodec and libssl, but there are probably more.

The issue appeared with commit 924e4f3eaa502ce82fccf8537f021a796d158771 (and
the correlated d0e357ff45a75553dee3b17ed7d303bfa544f6fe) and is still present
in the latest commit (de477abcaaabb1f9815cb63876637a47a95e7ac1).

According to the messages in bug 29528, the changes were also applied to
version 2.35 and 2.34, so it's possible those are broken too.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/29600] dlmopen hangs after loading certain libraries

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29600

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
                 CC|                            |fweimer at redhat dot com
   Last reconfirmed|                            |2022-09-22
              Flags|                            |security-
     Ever confirmed|0                           |1

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
I can reproduce this. It's because we zero _ns_debug now, and the code in
elf/dl-debug.c does not cope with that.

I've already posted a patch series that removes _ns_debug again, but just
clearing libc_map instead of the full memset is probably the more conservative
approach here.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/29600] dlmopen hangs after loading certain libraries

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29600

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://sourceware.org/bugz
                   |                            |illa/show_bug.cgi?id=29528

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/29600] dlmopen hangs after loading certain libraries

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29600

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |fweimer at redhat dot com
             Status|NEW                         |ASSIGNED

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
Patch posted:

[PATCH] elf: Do not completely clear reused namespace in dlmopen (bug 29600)
<https://sourceware.org/pipermail/libc-alpha/2022-September/142199.html>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/29600] dlmopen hangs after loading certain libraries

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29600

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
   Target Milestone|---                         |2.37
         Resolution|---                         |FIXED

--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for 2.37 via:

commit 2c42257314536b94cc8d52edede86e94e98c1436
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Oct 14 11:02:25 2022 +0200

    elf: Do not completely clear reused namespace in dlmopen (bug 29600)

    The data in the _ns_debug member must be preserved, otherwise
    _dl_debug_initialize enters an infinite loop.  To be conservative,
    only clear the libc_map member for now, to fix bug 29528.

    Fixes commit d0e357ff45a75553dee3b17ed7d303bfa544f6fe
    ("elf: Call __libc_early_init for reused namespaces (bug 29528)"),
    by reverting most of it.

    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
    Tested-by: Carlos O'Donell <carlos@redhat.com>

Backporting is in progress.

-- 
You are receiving this mail because:
You are on the CC list for the bug.