[Bug dynamic-link/31168] New: ld.so startup segfaults if constructor does dlopen with RTLD_GLOBAL

["srk31 at srcf dot ucam.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=31168

            Bug ID: 31168
           Summary: ld.so startup segfaults if constructor does dlopen
                    with RTLD_GLOBAL
           Product: glibc
           Version: 2.35
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: srk31 at srcf dot ucam.org
  Target Milestone: ---

Created attachment 15260
  --> https://sourceware.org/bugzilla/attachment.cgi?id=15260&action=edit
small reproducer

The ld.so of glibc 2.36 (and likely later but I haven't tested) may crash
during _dl_init of the main executable, if an early constructor does a dlopen
with RTLD_GLOBAL.

The problem seems to be that `add_to_global_update()` adds to
`main_map->l_searchlist.r_nlist` but `main_map->l_initfini` is not resized to
match. This is a problem since `r_nlist` is used to bound the call_init loop in
dl-init.c, which ranges over `l_initfini`: 

135       i = main_map->l_searchlist.r_nlist;
136       while (i-- > 0)
137         call_init (main_map->l_initfini[i], argc, argv, env);

... meaning the loop will run off the end of the `l_initfini` list, calling
`call_init` passing the NULL terminator value instead of a link map.

See attached test case... this is doing dlopen during the constructor of an
initfirst preloaded object. I'm not sure whether it can be reproduced without
initfirst and/or preloading... this combination closely models my use case,
which was working fine until at least 2.28.

-- 
You are receiving this mail because:
You are on the CC list for the bug.