[Bug dynamic-link/30424] New: Calling dlopen from preinit function inhibits proper libc initialization

[Bug dynamic-link/30424] New: Calling dlopen from preinit function inhibits proper libc initialization

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30424

            Bug ID: 30424
           Summary: Calling dlopen from preinit function inhibits proper
                    libc initialization
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---

Reproducer:

#define _GNU_SOURCE
#include <dlfcn.h>
#include <gnu/lib-names.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

static void
preinit (int argc, char **argv, char **envp)
{
  printf ("environ: %p\n", environ);
  printf ("USER: %s\n", getenv ("USER"));
  if (argc != 1)
    dlopen (LIBC_SO, RTLD_NOW);
}

static void (*const preinit_array []) (int, char **, char **)
     __attribute__ ((section (".preinit_array"), aligned (sizeof (void *)),
                     used)) =
{
  &preinit,
};

int
main (void)
{
  printf ("environ: %p\n", environ);
  printf ("USER: %s\n", getenv ("USER"));
}

Running it without any arguments:

environ: (nil)
USER: (null)
environ: 0x7ffe9b2dcc88
USER: fweimer

This is sort-of expected because at preinit time, libc is not fully initialized
yet because the ELF constructors have not run.

Running with an argument triggers the dlopen:

environ: (nil)
USER: (null)
environ: (nil)
USER: (null)

This is unexpected.  The reason is that _dl_open (in ld.so) does not use the
original data from the kernel, but receives the values to use from dlopen (in
libc.so). But as libc.so is not fully initialized at preinit time, it cannot
initialize itself. The fact that ELF constructors have run is recorded, so the
full initialization is never performed.

I think we should keep passing down at least environ from libc.so to ld.so
because environ can change legitimately. Nowadays, we have __libc_early_init,
we can use it to get rid of ELF constructors and initialize libc.so fully
before application code runs. This should resolve the issue because
__libc_early_init runs before the preinit functions.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30424] Calling dlopen from preinit function inhibits proper libc initialization

[asn at samba dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30424

Andreas Schneider <asn at samba dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |asn at samba dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30424] Calling dlopen from preinit function inhibits proper libc initialization

[asn at samba dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30424

--- Comment #1 from Andreas Schneider <asn at samba dot org> ---
The libssh project uses cwrap [1] to run tests against the openssh sshd server.
When trying to use AddressSanitizer with our test environment we ran into this
issue [2]. Florian helped to debug the issue we see and tracked it down to this
problem.

We have environment variables to disable RTLD_DEEPBIND in the wrappers. However
the envrion is empty somehow and we get RTLD_DEEPBIND:

==31700==You are trying to dlopen a libc.so.6 shared library with RTLD_DEEPBIND
flag which is incompatible with sanitizer runtime (see
https://github.com/google/sanitizers/issues/611 for details). If you want to
run libc.so.6 library under sanitizers please remove RTLD_DEEPBIND from dlopen
flags.

It would be really great to run AddressSanitzer with our testsuite but we need
this fixed.

[1] https://cwrap.org
[2] https://gitlab.com/cryptomilk/libssh-mirror/-/commits/asn-asan

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30424] Calling dlopen from preinit function inhibits proper libc initialization

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30424

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.