Re: [PATCH] Avoid deadlock in malloc on backtrace

[Szabolcs Nagy <nsz at port70 dot net>]

* Carlos O'Donell <carlos@redhat.com> [2015-02-26 17:18:04 -0500]:
> (1) Delaying the abort is bad for security.
> 
> Problem: The library should abort() immediately from a security perspective.
> 
> Solution: Don't delay, call abort() immediately.

i think from security pov immediate crash (__builtin_trap) is the right solution

abort is complex (eg glibc tries to fflush stdio buffers)

> (2) Use a simpler backtrace.
> - Use a backtrace that doesn't require dlopen, or malloc.
> 
> One doesn't exist, and would be hard to create, just look at the
> work it took to get the unwinder to the level that it is in gcc
> today.

dlopen("libgcc_s.so") is bad

when glibc and gcc are not the installed host tools it will use
the wrong library because nobody would expect the libc to open
shared objects of the compiler at runtime so that wont be in the
library path: eg. the testrun.sh in glibc does not expect it

> (5) Dynamically link with _Unwind_Backtrace to avoid dlopen's malloc.
> - Link dynamically with libgcc_s.so in order to have immediate access
>   to the unwinder.

as far as i'm concerned libgcc_s should not exist:
such dependency between the c runtime and the compiler is bound to
break things

(i would be happy with a dummy backtrace)