[Bug libc/6710] New: Observed crash due after dlclose() involving DF_1_NODELETE dependency

["tstarling at wikimedia dot org" <sourceware-bugzilla at sourceware dot org>]

This bug affects the PHP component called APC, on 64-bit architectures only. I
haven't been able to reproduce it outside of APC, but it looks very much like a
glibc problem. It involves dynamic library dependencies that have DF_1_NODELETE
set in their .dynamic section.

Here's the APC bug report:

http://pecl.php.net/bugs/bug.php?id=10253

I reported it to APC over a year ago. We saw it on redhat, and a credible
comment says that it also affects Debian etch. 

The sequence of events is as follows:
1. Apache dlopens PHP and calls an init function
2. PHP dlopens APC
3. APC depends on librt, so the dynamic linker automatically opens librt
4. Apache finishes configuring and then calls dlclose on PHP. This appears to
free the link map for librt. But because librt has DF_1_NODELETE, it's not
actually deleted, so the link map becomes a dangling pointer.
5. Apache forks lots of times, and each child process dlopens PHP again. Each
child process calls PHP's init function, and so APC is opened again.
6. Exit apache normally
7. During shutdown, glibc attempts to resolve __cxa_finalize from librt. Due to
the corruption of the link map in step 4, it segfaults.

I tried to reproduce this sequence using a simple test app, but it didn't work.
So, to reproduce:

* Use x86_64
* Compile and install Apache 1.3.x, PHP and APC as per standard install instructions
* Confirm that PHP and APC are enabled, say with strace -e trace=open httpd -X
* Run Apache under gdb
* Send SIGTERM, or arrange to have it exit with an error when it tries to bind
port 80
* It should segfault in do_lookup_x()

-- 
           Summary: Observed crash due after dlclose() involving
                    DF_1_NODELETE dependency
           Product: glibc
           Version: 2.3.6
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: tstarling at wikimedia dot org
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: x86_64-redhat-linux
  GCC host triplet: x86_64-redhat-linux
GCC target triplet: x86_64-redhat-linux


http://sourceware.org/bugzilla/show_bug.cgi?id=6710

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.