From patchwork Thu Jun 4 13:20:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 39474 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id D5583388F06B; Thu, 4 Jun 2020 13:20:17 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D5583388F06B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1591276817; bh=J+VMKEfB4oEDCyy1azwVhVtFpmPsgzmZxZS/R85rGUo=; h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=lSnH3Z3INcHuqsmBh13w09gR3cS2YH5DuJOzNL0m4jo6CYwWwkEzo4jWACvjwLMzZ zCeoRoaVjbDkQuOjfoGTI/o3oVgzuutv7Ee9PJGPlLHT13T7003eKwNBcupWtPg+jE OrOQGsHWr+qATIM3sPEITYUuaraM2gVr7x/NI4ek= X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from us-smtp-delivery-1.mimecast.com (us-smtp-2.mimecast.com [207.211.31.81]) by sourceware.org (Postfix) with ESMTP id 670FE3840C1D for ; Thu, 4 Jun 2020 13:20:15 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 670FE3840C1D Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-201-Fy5lSBJ0NtOYehvEeqj3yA-1; Thu, 04 Jun 2020 09:20:10 -0400 X-MC-Unique: Fy5lSBJ0NtOYehvEeqj3yA-1 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 59DE38054AB for ; Thu, 4 Jun 2020 13:20:09 +0000 (UTC) Received: from oldenburg2.str.redhat.com (ovpn-114-15.ams2.redhat.com [10.36.114.15]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D0B7351328 for ; Thu, 4 Jun 2020 13:20:08 +0000 (UTC) To: libc-alpha@sourceware.org Subject: [PATCH] elf: Fix crash in late dlmopen failure when auditing (bug 26076) Date: Thu, 04 Jun 2020 15:20:07 +0200 Message-ID: <87sgfbufw8.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com X-Spam-Status: No, score=-13.2 required=5.0 tests=BAYES_00, DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H4, RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Florian Weimer via Libc-alpha From: Florian Weimer Reply-To: Florian Weimer Errors-To: libc-alpha-bounces@sourceware.org Sender: "Libc-alpha" If _dl_map_object_deps fails, the initial module that has been loaded by _dl_map_objects needs to be freed using _dl_close_worker. This produces an empty namespace midway through _dl_close_worker. The code did not expected and deferefenced a NULL pointer. --- elf/Makefile | 16 +++++++++++++++- elf/dl-close.c | 2 +- 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/elf/Makefile b/elf/Makefile index 6fe1df90bb..648d6d3d11 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -223,7 +223,7 @@ tests += $(tests-execstack-$(have-z-execstack)) ifeq ($(run-built-tests),yes) tests-special += $(objpfx)tst-leaks1-mem.out \ $(objpfx)tst-leaks1-static-mem.out $(objpfx)noload-mem.out \ - $(objpfx)tst-ldconfig-X.out + $(objpfx)tst-ldconfig-X.out $(objpfx)tst-auditlatefail.out endif tlsmod17a-suffixes = 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 tlsmod18a-suffixes = 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 @@ -1502,6 +1502,20 @@ $(objpfx)tst-auditmany.out: $(objpfx)tst-auditmanymod1.so \ tst-auditmany-ENV = \ LD_AUDIT=tst-auditmanymod1.so:tst-auditmanymod2.so:tst-auditmanymod3.so:tst-auditmanymod4.so:tst-auditmanymod5.so:tst-auditmanymod6.so:tst-auditmanymod7.so:tst-auditmanymod8.so:tst-auditmanymod9.so +# Check that a late failure in loading an audit module does not result +# in a segmentation fault (bug 26076). Reuse parts of the +# tst-auditmany test for this. They tst-auditmany program just exits +# with zero, after loading has failed. Check that the expected audit +# module load error message appears on standard error, and that output +# from the other (successfully loaded) audit module occurred. +$(objpfx)tst-auditlatefail.out: $(objpfx)tst-auditmanymod1.so \ + $(objpfx)tst-dlopenfailmod1.so $(objpfx)tst-auditmany Makefile + $(test-wrapper) $(rtld-prefix) \ + --audit tst-auditmanymod1.so:tst-dlopenfailmod1.so \ + $(objpfx)tst-auditmany > $@ 2>&1 && \ + grep -q "object 'tst-dlopenfailmod1.so' cannot be loaded as audit interface: cannot open shared object file; ignored." $@ && \ + grep -q "^info: 1, la_objopen" $@; $(evaluate-test) + LDFLAGS-tst-audit14 = -Wl,--audit=tst-auditlogmod-1.so $(objpfx)tst-auditlogmod-1.so: $(libsupport) $(objpfx)tst-audit14.out: $(objpfx)tst-auditlogmod-1.so diff --git a/elf/dl-close.c b/elf/dl-close.c index 73b2817bbf..896e59e42e 100644 --- a/elf/dl-close.c +++ b/elf/dl-close.c @@ -782,7 +782,7 @@ _dl_close_worker (struct link_map *map, bool force) { struct link_map *head = ns->_ns_loaded; /* Do not call the functions for any auditing object. */ - if (head->l_auditing == 0) + if (head != NULL && head->l_auditing == 0) { struct audit_ifaces *afct = GLRO(dl_audit); for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)