From patchwork Thu Mar 16 05:12:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maninder Singh X-Patchwork-Id: 19595 Received: (qmail 112577 invoked by alias); 16 Mar 2017 05:22:14 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 112544 invoked by uid 89); 16 Mar 2017 05:22:13 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-25.9 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_LAZY_DOMAIN_SECURITY, RP_MATCHES_RCVD, SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=H*r:Symantec, HContent-type:utf-8, HX-CFilter-Loop:Reflected, Hx-spam-relays-external:ESMTPA X-HELO: mailout1.samsung.com From: Maninder Singh To: libc-alpha@sourceware.org Cc: pankaj.m@samsung.com, hakbong5.lee@samsung.com, a.sahrawat@samsung.com, ajeet.y@samsung.com, Maninder Singh , Vaneet Narang Subject: [PATCH 1/1] dl-load: add memory barrier before updating the next. Date: Thu, 16 Mar 2017 10:42:02 +0530 Message-id: <1489641122-35462-1-git-send-email-maninder1.s@samsung.com> X-CMS-MailID: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 X-Msg-Generator: CA X-Sender-IP: 182.195.40.14 X-Local-Sender: =?UTF-8?B?TWFuaW5kZXIgU2luZ2gbU1JJLURlbGhpLVBsYXRmb3JtIFMv?= =?UTF-8?B?VyAxIFRlYW0b7IK87ISx7KCE7J6QG0xlYWQgRW5naW5lZXI=?= X-Global-Sender: =?UTF-8?B?TWFuaW5kZXIgU2luZ2gbU1JJLURlbGhpLVBsYXRmb3JtIFMv?= =?UTF-8?B?VyAxIFRlYW0bU2Ftc3VuZ8KgRWxlY3Ryb25pY3PCoBtMZWFkIEVuZ2luZWVy?= X-Sender-Code: =?UTF-8?B?QzEwG1NXQUhRG0MxMElEMDJJRDAyODExNQ==?= Content-type: text/plain; charset=utf-8 X-MTR: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 X-EPHeader: CA CMS-TYPE: 105P DLP-Filter: Pass X-CFilter-Loop: Reflected X-Auth-Email: maninder1.s@samsung.com X-HopCount: 7 X-CMS-RootMailID: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 X-RootMTR: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 References: This patch adds memory barrier before updating the liblist next. Issue Fix: race condition between add_name_to_object & _dl_name_match_p. One threads calling dlopen which further calls add_name_to_object & other thread trying to resolve RTLD_LAZY symbols through _dl_runtime_resolve which further calls. _dl_name_match_p checks if libname->next is valid, then it assumes libname->next->name to be valid. Also add_name_to_object initialized name first and then sets valid next pointer. This patch avoids any reorder of instruction when next is set before name to avoid any race. Signed-off-by: Maninder Singh Signed-off-by: Vaneet Narang --- elf/dl-load.c | 1 + 1 file changed, 1 insertion(+) diff --git a/elf/dl-load.c b/elf/dl-load.c index 016a99c..c1e69b8 100644 --- a/elf/dl-load.c +++ b/elf/dl-load.c @@ -429,6 +429,7 @@ add_name_to_object (struct link_map *l, const char *name) newname->name = memcpy (newname + 1, name, name_len); newname->next = NULL; newname->dont_free = 0; + atomic_write_barrier (); lastp->next = newname; }