about summary refs log tree commit diff
path: root/elf/dl-close.c
diff options
context:
space:
mode:
authorMaxim Ostapenko <m.ostapenko@partner.samsung.com>2015-08-10 10:47:54 +0300
committerAndreas Schwab <schwab@suse.de>2015-08-11 10:13:22 +0200
commitf25238ffe0455013174438376b3ee88df496f9d1 (patch)
tree6cd3e27f694193ddc4f45258d09f1f4fb9f17801 /elf/dl-close.c
parentdc8a7ff24dfd1fd97a50b4b83a715958b31e4b92 (diff)
downloadglibc-f25238ffe0455013174438376b3ee88df496f9d1.tar.gz
glibc-f25238ffe0455013174438376b3ee88df496f9d1.tar.xz
glibc-f25238ffe0455013174438376b3ee88df496f9d1.zip
Clear DF_1_NODELETE flag only for failed to load library.
https://sourceware.org/bugzilla/show_bug.cgi?id=18778

If dlopen fails to load an object that has triggered loading libpthread it
causes ld.so to unload libpthread because its DF_1_NODELETE flags has been
forcefully cleared. The next call to __rtdl_unlock_lock_recursive will crash
since pthread_mutex_unlock no longer exists.

This patch moves l->l_flags_1 &= ~DF_1_NODELETE out of loop through all loaded
libraries and performs the action only on inconsistent one.

	[BZ #18778]
	* elf/Makefile (tests): Add Add tst-nodelete2.
	(modules-names): Add tst-nodelete2mod.
	(tst-nodelete2mod.so-no-z-defs): New.
	($(objpfx)tst-nodelete2): Likewise.
	($(objpfx)tst-nodelete2.out): Likewise.
	(LDFLAGS-tst-nodelete2): Likewise.
	* elf/dl-close.c (_dl_close_worker): Move DF_1_NODELETE clearing
	out of loop through all loaded libraries.
	* elf/tst-nodelete2.c: New file.
	* elf/tst-nodelete2mod.c: Likewise.
Diffstat (limited to 'elf/dl-close.c')
-rw-r--r--elf/dl-close.c15
1 files changed, 8 insertions, 7 deletions
diff --git a/elf/dl-close.c b/elf/dl-close.c
index 910527746e..c8972471ee 100644
--- a/elf/dl-close.c
+++ b/elf/dl-close.c
@@ -144,6 +144,14 @@ _dl_close_worker (struct link_map *map, bool force)
   char done[nloaded];
   struct link_map *maps[nloaded];
 
+  /* Clear DF_1_NODELETE to force object deletion.  We don't need to touch
+     l_tls_dtor_count because forced object deletion only happens when an
+     error occurs during object load.  Destructor registration for TLS
+     non-POD objects should not have happened till then for this
+     object.  */
+  if (force)
+    map->l_flags_1 &= ~DF_1_NODELETE;
+
   /* Run over the list and assign indexes to the link maps and enter
      them into the MAPS array.  */
   int idx = 0;
@@ -153,13 +161,6 @@ _dl_close_worker (struct link_map *map, bool force)
       maps[idx] = l;
       ++idx;
 
-      /* Clear DF_1_NODELETE to force object deletion.  We don't need to touch
-	 l_tls_dtor_count because forced object deletion only happens when an
-	 error occurs during object load.  Destructor registration for TLS
-	 non-POD objects should not have happened till then for this
-	 object.  */
-      if (force)
-	l->l_flags_1 &= ~DF_1_NODELETE;
     }
   assert (idx == nloaded);