* [PATCH v3] dl-load: add memory barrier before updating the next
[not found] <CGME20170403113000epcas5p37d569cf71eda2d413cfab5e7f7e3591d@epcas5p3.samsung.com>
@ 2017-04-03 11:30 ` Maninder Singh
2017-04-03 11:45 ` Andreas Schwab
2017-04-03 13:25 ` Torvald Riegel
0 siblings, 2 replies; 3+ messages in thread
From: Maninder Singh @ 2017-04-03 11:30 UTC (permalink / raw)
To: libc-alpha, triegel, szabolcs.nagy
Cc: pankaj.m, ajeet.y, a.sahrawat, lalit.mohan, akhilesh.k,
hakbong5.lee, Maninder Singh, Vaneet Narang
[BZ #21349]: race condition between dl_open and rtld lazy symbol resolve.
This patch adds C11 memory barrier before updating the liblist next.
Issue Fix: race condition between add_name_to_object & _dl_name_match_p.
One threads calling dlopen which further calls add_name_to_object &
other thread trying to resolve RTLD_LAZY symbols through
_dl_runtime_resolve which further calls.
_dl_name_match_p checks if libname->next is valid, then it assumes
libname->next->name to be valid. Also add_name_to_object initialized
name first and then sets valid next pointer.
This patch avoids any reorder of instruction when next is set before
name to avoid any race.
Signed-off-by: Vaneet Narang <v.narang@samsung.com>
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
---
v1 -> v2: use C11 atomics rather than direct memory barriers.
v2 -> v3: use comments for barriers and enter Bugzilla ID.
elf/dl-load.c | 5 ++++-
elf/dl-misc.c | 5 ++++-
2 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/elf/dl-load.c b/elf/dl-load.c
index a5318f9..03c6afb 100644
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -418,7 +418,10 @@ add_name_to_object (struct link_map *l, const char *name)
newname->name = memcpy (newname + 1, name, name_len);
newname->next = NULL;
newname->dont_free = 0;
- lastp->next = newname;
+ /* We need release memory order here because we need to synchronize
+ with other thread doing _dl_runtime_resolve which calls _dl_name_match_p
+ to traverse all names added to libname_list*/
+ atomic_store_release (&(lastp->next), newname);
}
/* Standard search directories. */
diff --git a/elf/dl-misc.c b/elf/dl-misc.c
index 1e9a6ee..a26d6f6 100644
--- a/elf/dl-misc.c
+++ b/elf/dl-misc.c
@@ -295,7 +295,10 @@ _dl_name_match_p (const char *name, const struct link_map *map)
if (strcmp (name, runp->name) == 0)
return 1;
else
- runp = runp->next;
+ /* We need to acquire memory order here because we need to synchronize
+ with other thread calling dlopen and adding new name to libname_list
+ through add_name_to_object */
+ runp = atomic_load_acquire(&(runp->next));
return 0;
}
--
1.7.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v3] dl-load: add memory barrier before updating the next
2017-04-03 11:30 ` [PATCH v3] dl-load: add memory barrier before updating the next Maninder Singh
@ 2017-04-03 11:45 ` Andreas Schwab
2017-04-03 13:25 ` Torvald Riegel
1 sibling, 0 replies; 3+ messages in thread
From: Andreas Schwab @ 2017-04-03 11:45 UTC (permalink / raw)
To: Maninder Singh
Cc: libc-alpha, triegel, szabolcs.nagy, pankaj.m, ajeet.y,
a.sahrawat, lalit.mohan, akhilesh.k, hakbong5.lee, Vaneet Narang
On Apr 03 2017, Maninder Singh <maninder1.s@samsung.com> wrote:
> diff --git a/elf/dl-load.c b/elf/dl-load.c
> index a5318f9..03c6afb 100644
> --- a/elf/dl-load.c
> +++ b/elf/dl-load.c
> @@ -418,7 +418,10 @@ add_name_to_object (struct link_map *l, const char *name)
> newname->name = memcpy (newname + 1, name, name_len);
> newname->next = NULL;
> newname->dont_free = 0;
> - lastp->next = newname;
> + /* We need release memory order here because we need to synchronize
> + with other thread doing _dl_runtime_resolve which calls _dl_name_match_p
> + to traverse all names added to libname_list*/
> + atomic_store_release (&(lastp->next), newname);
Please remove the redundant parens.
> diff --git a/elf/dl-misc.c b/elf/dl-misc.c
> index 1e9a6ee..a26d6f6 100644
> --- a/elf/dl-misc.c
> +++ b/elf/dl-misc.c
> @@ -295,7 +295,10 @@ _dl_name_match_p (const char *name, const struct link_map *map)
> if (strcmp (name, runp->name) == 0)
> return 1;
> else
> - runp = runp->next;
> + /* We need to acquire memory order here because we need to synchronize
> + with other thread calling dlopen and adding new name to libname_list
> + through add_name_to_object */
> + runp = atomic_load_acquire(&(runp->next));
Likewise.
Andreas.
--
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v3] dl-load: add memory barrier before updating the next
2017-04-03 11:30 ` [PATCH v3] dl-load: add memory barrier before updating the next Maninder Singh
2017-04-03 11:45 ` Andreas Schwab
@ 2017-04-03 13:25 ` Torvald Riegel
1 sibling, 0 replies; 3+ messages in thread
From: Torvald Riegel @ 2017-04-03 13:25 UTC (permalink / raw)
To: Maninder Singh
Cc: libc-alpha, szabolcs.nagy, pankaj.m, ajeet.y, a.sahrawat,
lalit.mohan, akhilesh.k, hakbong5.lee, Vaneet Narang
On Mon, 2017-04-03 at 16:58 +0530, Maninder Singh wrote:
> [BZ #21349]: race condition between dl_open and rtld lazy symbol resolve.
>
> This patch adds C11 memory barrier before updating the liblist next.
>
> Issue Fix: race condition between add_name_to_object & _dl_name_match_p.
> One threads calling dlopen which further calls add_name_to_object &
> other thread trying to resolve RTLD_LAZY symbols through
> _dl_runtime_resolve which further calls.
>
> _dl_name_match_p checks if libname->next is valid, then it assumes
> libname->next->name to be valid. Also add_name_to_object initialized
> name first and then sets valid next pointer.
>
> This patch avoids any reorder of instruction when next is set before
> name to avoid any race.
>
> Signed-off-by: Vaneet Narang <v.narang@samsung.com>
> Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
Please address my comments on v2 of your patch too.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-04-03 13:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CGME20170403113000epcas5p37d569cf71eda2d413cfab5e7f7e3591d@epcas5p3.samsung.com>
2017-04-03 11:30 ` [PATCH v3] dl-load: add memory barrier before updating the next Maninder Singh
2017-04-03 11:45 ` Andreas Schwab
2017-04-03 13:25 ` Torvald Riegel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).