This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCHv5][PING^3][BZ #17833] _dl_close_worker() does not release inconsistent objects.
- From: Andreas Schwab <schwab at suse dot de>
- To: Pavel Kopyl <p dot kopyl at samsung dot com>
- Cc: "H.J. Lu" <hjl dot tools at gmail dot com>, Yury Gribov <y dot gribov at samsung dot com>, Roland McGrath <roland at hack dot frob dot com>, GNU C Library <libc-alpha at sourceware dot org>, Carlos O'Donell <carlos at redhat dot com>, Viacheslav Garbuzov <v dot garbuzov at samsung dot com>
- Date: Thu, 06 Aug 2015 16:12:22 +0200
- Subject: Re: [PATCHv5][PING^3][BZ #17833] _dl_close_worker() does not release inconsistent objects.
- Authentication-results: sourceware.org; auth=none
- References: <54BD4F65 dot 2090108 at samsung dot com> <553A1BEE dot 6070705 at samsung dot com> <CAMe9rOqiyuyNAtJDZGbfs+0kk0j16-Vowp5f0z_x2zfsd76fMQ at mail dot gmail dot com> <5553382F dot 3020906 at samsung dot com> <5565B5E5 dot 7060101 at samsung dot com> <CAMe9rOr8yDpnHtRFbL3M56Sx5FWX-FVqEstnwsgtW6H+khvziQ at mail dot gmail dot com> <5565C2A8 dot 60306 at samsung dot com> <CAMe9rOq++pD-ugdYFEte49v8TLZEM505J+=WzPTOT_Lo-MdDHQ at mail dot gmail dot com> <5565C862 dot 1040003 at samsung dot com> <CAMe9rOo7TStj3SX8OK8s3H3G=2Pyr1WKTW=R-=SzVFBWY8PF0A at mail dot gmail dot com> <5566395A dot 3090605 at samsung dot com> <CAMe9rOp4Jrz4AE3-C5VmJ0PLmxoST3phyEQt3t59ag6UGbimBw at mail dot gmail dot com> <5567892C dot 4070004 at samsung dot com> <5568A408 dot 2080903 at samsung dot com> <5592AB91 dot 2050709 at samsung dot com> <CAMe9rOoK64VuNfgZ-8_BTqes0tJcpc55atKw1k6ewBTwFzuGKg at mail dot gmail dot com> <5595C0F8 dot 3060300 at samsung dot com> <CAMe9rOof9j6RwGgNGuxXUgBnYXK0c_UAp3zN2Ne4JhHqiZMFEQ at mail dot gmail dot com> <559B829C dot 8080700 at samsung dot com> <CAMe9rOom4ttO2cGYGovagHpu3zy4L7qn+7E4jm7k=5rD+xgNaQ at mail dot gmail dot com> <559BFDDC dot 4010604 at samsung dot com>
Pavel Kopyl <p.kopyl@samsung.com> writes:
> @@ -152,6 +152,10 @@ _dl_close_worker (struct link_map *map)
> l->l_idx = idx;
> maps[idx] = l;
> ++idx;
> +
> + /* clear DF_1_NODELETE to force object deletion. */
> + if (force)
> + l->l_flags_1 &= ~DF_1_NODELETE;
This is a very bad idea. It can cause libpthread to be unloaded, which
will crash ld.so on the next __rtld_lock_unlock.
Andreas.
--
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE 1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."