elf: Include libc.so.6 as main program in dependency sort (bug 20972)

_dl_map_object_deps always sorts the initially loaded object first
during dependency sorting.  This means it is relocated last in
dl_open_worker.  This results in crashes in IFUNC resolvers without
lazy bindings if libraries are preloaded that refer to IFUNCs in
libc.so.6: the resolvers are called when libc.so.6 has not been
relocated yet, so references to _rtld_global_ro etc. crash.

The fix is to check against the libc.so.6 link map recorded by the
__libc_early_init framework, and let it participate in the dependency
sort.

This fixes bug 20972.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>

1 files changed, 6 insertions, 1 deletions

diff --git a/elf/dl-deps.c b/elf/dl-deps.c
index b5a43232a7..7a8d8ce988 100644
--- a/elf/dl-deps.c
+++ b/elf/dl-deps.c
@@ -611,7 +611,12 @@ Filters not supported with LD_TRACE_PRELINKING"));
     memcpy (l_initfini, map->l_searchlist.r_list,
 	    nlist * sizeof (struct link_map *));
 
-  _dl_sort_maps (&l_initfini[1], nlist - 1, NULL, false);
+  /* If libc.so.6 is the main map, it participates in the sort, so
+     that the relocation order is correct regarding libc.so.6.  */
+  if (l_initfini[0] == GL (dl_ns)[l_initfini[0]->l_ns].libc_map)
+    _dl_sort_maps (l_initfini, nlist, NULL, false);
+  else
+    _dl_sort_maps (&l_initfini[1], nlist - 1, NULL, false);
 
   /* Terminate the list of dependencies.  */
   l_initfini[nlist] = NULL;