[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 16 Feb 2016 22:55:50 +0100
From: Szabolcs Nagy <nsz@...t70.net>
To: musl@...ts.openwall.com
Subject: Re: dynlink.c: bug in reclaim_gaps leading to segfault in
__libc_exit_fini
* Hugues Bruant <hugues@...ofs.com> [2016-02-16 16:30:42 -0500]:
> Affects both 1.1.12 and 1.1.13
>
> Tracked down with valgrind in Alpine Linux 3.3.
>
> The dmg tool build from https://github.com/aerofs/libdmg-hfsplus links to a
> handful shared libs. The following message is seen immediately at start:
>
> ==59== Invalid free() / delete / delete[] / realloc()
> ==59== at 0x4C92B0E: free (vg_replace_malloc.c:530)
> ==59== by 0x4056F68: reclaim_gaps (dynlink.c:488)
> ==59== by 0x405743D: map_library (dynlink.c:708)
> ==59== by 0x4057EF3: load_library (dynlink.c:1014)
> ==59== by 0x4058CA8: load_preload (dynlink.c:1112)
> ==59== by 0x4058CA8: __dls3 (dynlink.c:1581)
> ==59== by 0x405856A: __dls2 (dynlink.c:1383)
> ==59== by 0x405655E: ??? (in /lib/ld-musl-x86_64.so.1)
> ==59== by 0x3: ???
> ==59== by 0xFFF000E3A: ???
> ==59== by 0xFFF000E3E: ???
> ==59== by 0xFFF000E44: ???
> ==59== by 0xFFF000E86: ???
>
> Afterwards, the program proceeds with no issue, until it exists, at which
> point a segfault is triggered when cleaning up shared libraries:
>
this is not a bug.
valgrind is not aware of dynamic linker internals,
you have to use a musl specific suppression file
to hide this message (but i dont know if anybody
wrote such thing for valgrind).
> ==38== Invalid read of size 8
> ==38== at 0x4057551: decode_vec.constprop.5 (dynlink.c:171)
> ==38== by 0x405825C: __libc_exit_fini (dynlink.c:1197)
> ==38== by 0x4016233: exit (exit.c:31)
> ==38== by 0x401D635: (below main) (__libc_start_main.c:74)
> ==38== Address 0x636f8f53ebff9f53 is not stack'd, malloc'd or (recently) free'd
> ==38==
> ==38==
> ==38== Process terminating with default action of signal 11 (SIGSEGV)
> ==38== General Protection Fault
> ==38== at 0x4057551: decode_vec.constprop.5 (dynlink.c:171)
> ==38== by 0x405825C: __libc_exit_fini (dynlink.c:1197)
> ==38== by 0x4016233: exit (exit.c:31)
> ==38== by 0x401D635: (below main) (__libc_start_main.c:74)
> ==38==
>
>
> The first 32 bytes of one of the dso struct are manifestly corrupted.
>
> Patching reclaim_gap as follows fixes the segfault:
>
there is a corruption, but it is not caused by
reclaim gaps, removing it just hides the problem
(becaues then early mallocs happen to go elsewhere
where they are not corrupted).
needs more investigation.
> diff --git a/ldso/dynlink.c b/ldso/dynlink.c
> index 87f3b7f..f897dbd 100644
> --- a/ldso/dynlink.c
> +++ b/ldso/dynlink.c
> @@ -484,9 +484,9 @@ static void reclaim_gaps(struct dso *dso)
> for (; phcnt--; ph=(void *)((char *)ph+dso->phentsize)) {
> if (ph->p_type!=PT_LOAD) continue;
> if ((ph->p_flags&(PF_R|PF_W))!=(PF_R|PF_W)) continue;
> - reclaim(dso, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr);
> - reclaim(dso, ph->p_vaddr+ph->p_memsz,
> - ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE);
> + //reclaim(dso, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr);
> + //reclaim(dso, ph->p_vaddr+ph->p_memsz,
> + // ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE);
> }
> }
>
>
> For more details: https://bugs.alpinelinux.org/issues/5123
>
> Regards,
> Hugues
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
