[Bug dynamic-link/30981] New: dlclose does not properly implement force-first handling

[Bug dynamic-link/30981] New: dlclose does not properly implement force-first handling

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30981

            Bug ID: 30981
           Summary: dlclose does not properly implement force-first
                    handling
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---

The ELF destructor for the dlclose'd object should run first, but that does not
happen due to two factors:

The array passed to _dl_sort_maps is gathered from the linked list of all
shared objects. In case of cycles and an unfortuate dlopen/dlclose order, the
first array element may not be the link map passed to dlclose, so the
force_first flag does not have the intended effect.

Inside _dl_sort_maps_dfs, the relocation dependency sorting (for_fini mode) has
early returns which bypass the force_first flag processing further down in the
function's source code. This means that force_first may not have any effect if
for_fini is active.

Fixing these two issues changes the results of the existing tst-bz15311 test
case:

-output(glibc.rtld.dynamic_sort=1):
{+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<a<c<d<g<f<b<e];}
-output(glibc.rtld.dynamic_sort=2):
{+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<g<f<a<b<c<d<e];}
+output(glibc.rtld.dynamic_sort=1):
{+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<a<b<c<d<g<f<e];}
+output(glibc.rtld.dynamic_sort=2):
{+a[d>c>b>a>];+e[e>];+f[f>];+g[g>];+d[];%d(b(e(a()))a()g(c(a()f(b(e(a()))))));-d[];-g[];-f[];-e[];-a[<a<g<f<b<c<d<e];}

In the glibc.rtld.dynamic_sort=1, the lack of nice abcd destructor ordering was
historically blamed on a sorting algorithm deficiency, while in reality it
seems to be a result of the incorrect way _dl_sort_maps was called by dlclose
(the first issue described above).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30981] dlclose does not properly implement force-first handling

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30981

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30981] dlclose does not properly implement force-first handling

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30981

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com
           See Also|                            |https://bugzilla.redhat.com
                   |                            |/show_bug.cgi?id=2244992

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30981] dlclose does not properly implement force-first handling

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30981

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|https://bugzilla.redhat.com |https://issues.redhat.com/b
                   |/show_bug.cgi?id=2244992    |rowse/RHEL-12362

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30981] dlclose does not properly implement force-first handling

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30981

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.39
             Status|NEW                         |RESOLVED
           Assignee|unassigned at sourceware dot org   |fweimer at redhat dot com

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Fixed for 2.39 via:

commit 849274d48fc59bfa6db3c713c8ced8026b20f3b7
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Nov 16 19:55:35 2023 +0100

    elf: Fix force_first handling in dlclose (bug 30981)

    The force_first parameter was ineffective because the dlclose'd
    object was not necessarily the first in the maps array.  Also
    enable force_first handling unconditionally, regardless of namespace.
    The initial object in a namespace should be destructed first, too.

    The _dl_sort_maps_dfs function had early returns for relocation
    dependency processing which broke force_first handling, too, and
    this is fixed in this change as well.

    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/30981] dlclose does not properly implement force-first handling

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30981

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|https://issues.redhat.com/b |
                   |rowse/RHEL-12362            |

-- 
You are receiving this mail because:
You are on the CC list for the bug.