[Bug libc/1158] New: Order of invokation of atexit functions in DSOs.

["richard at ex-parrot dot com" <sourceware-bugzilla at sources dot redhat dot com>]

These are two separate but related bugs in the way in which __new_exitfn reuses
slots in the __exit_funcs list to store new atexit functions.  I'm reporting
them as a single bug report as I think that fixing the second bug invalidates
the first one.

First, when __cxa_finalize and/or exit iterates through the __exit_funcs list
calling the functions, they do it in the order:

  e->fn[e->idx], ..., e->fn[0], e->next->fn[32], e->next->fn[0], ...

(where e == __exit_funcs).  When __new_exitfn reuses slots, it should use the
last available slot first so that __cxa_finalize calls the registed functions in
the correct order.  In the current implementation, it looks for the last
available slot in each block, but iterates forwards through the blocks.

The second bug is that it is not in general safe to reuse slots at all.  Suppose
the main executable dlopens a DSO and calls into it causing functions to be
registered in the DSO with __cxa_atexit.  Now suppose the main executable
registers some of its own functions with __cxa_atexit before dlclosing the DSO.
 If afterwards the any further functions are registered with __cxa_atexit, these
will reuse the slots freed by __cxa_finalize in the DSO, and so will be called
out of order when the process exits.

-- 
           Summary: Order of invokation of atexit functions in DSOs.
           Product: glibc
           Version: 2.3.5
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: gotom at debian dot or dot jp
        ReportedBy: richard at ex-parrot dot com
                CC: glibc-bugs at sources dot redhat dot com


http://sources.redhat.com/bugzilla/show_bug.cgi?id=1158

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.