From patchwork Thu Mar 16 05:12:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maninder Singh X-Patchwork-Id: 739537 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3vkH0c3vdgz9ryZ for ; Thu, 16 Mar 2017 16:22:24 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="dSyE1erj"; dkim-atps=neutral DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id :content-type:references; q=dns; s=default; b=KhlzFaLYSDqxGKqOV5 WmBYOox6KELOBj8C2J3iKm/IobrBHunaToIfNCExY/qqkHwmRP8w7eSRif5QfXcz rbA1Dt9vS0ACYLbiIMBMok2fSA7bz2TZptTH0uVBmGbOmv5DturEXITaLjbr3y2p yWa/1nfP5c9Mo74DBsMLXRF6k= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:cc:subject:date:message-id :content-type:references; s=default; bh=k7CJbR0IYdgzaAerr2iSMsTm tVk=; b=dSyE1erjzBzcnsY4U8773kpCWDLE2iA9iswtYYIqSAdIsZGtzv9Lkjpj +k+X5Dt3BVbe5Xdr2FWe4/PnwU1Hat04Ih6d+R08pXfA5VM6Sxu1WmCpwNMHSPQM WIavb+XLQpb32CdGX83dhRyWfrfwNmF23L2QgKN6zhLtcp5JOLU= Received: (qmail 112577 invoked by alias); 16 Mar 2017 05:22:14 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 112544 invoked by uid 89); 16 Mar 2017 05:22:13 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-25.9 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_LAZY_DOMAIN_SECURITY, RP_MATCHES_RCVD, SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=H*r:Symantec, HContent-type:utf-8, HX-CFilter-Loop:Reflected, Hx-spam-relays-external:ESMTPA X-HELO: mailout1.samsung.com From: Maninder Singh To: libc-alpha@sourceware.org Cc: pankaj.m@samsung.com, hakbong5.lee@samsung.com, a.sahrawat@samsung.com, ajeet.y@samsung.com, Maninder Singh , Vaneet Narang Subject: [PATCH 1/1] dl-load: add memory barrier before updating the next. Date: Thu, 16 Mar 2017 10:42:02 +0530 Message-id: <1489641122-35462-1-git-send-email-maninder1.s@samsung.com> X-CMS-MailID: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 X-Msg-Generator: CA X-Sender-IP: 182.195.40.14 X-Local-Sender: =?UTF-8?B?TWFuaW5kZXIgU2luZ2gbU1JJLURlbGhpLVBsYXRmb3JtIFMv?= =?UTF-8?B?VyAxIFRlYW0b7IK87ISx7KCE7J6QG0xlYWQgRW5naW5lZXI=?= X-Global-Sender: =?UTF-8?B?TWFuaW5kZXIgU2luZ2gbU1JJLURlbGhpLVBsYXRmb3JtIFMv?= =?UTF-8?B?VyAxIFRlYW0bU2Ftc3VuZ8KgRWxlY3Ryb25pY3PCoBtMZWFkIEVuZ2luZWVy?= X-Sender-Code: =?UTF-8?B?QzEwG1NXQUhRG0MxMElEMDJJRDAyODExNQ==?= Content-type: text/plain; charset=utf-8 X-MTR: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 X-EPHeader: CA CMS-TYPE: 105P DLP-Filter: Pass X-CFilter-Loop: Reflected X-Auth-Email: maninder1.s@samsung.com X-HopCount: 7 X-CMS-RootMailID: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 X-RootMTR: 20170316051208epcas5p2d15680536ba99a6f05ecd6906750cd98 References: This patch adds memory barrier before updating the liblist next. Issue Fix: race condition between add_name_to_object & _dl_name_match_p. One threads calling dlopen which further calls add_name_to_object & other thread trying to resolve RTLD_LAZY symbols through _dl_runtime_resolve which further calls. _dl_name_match_p checks if libname->next is valid, then it assumes libname->next->name to be valid. Also add_name_to_object initialized name first and then sets valid next pointer. This patch avoids any reorder of instruction when next is set before name to avoid any race. Signed-off-by: Maninder Singh Signed-off-by: Vaneet Narang --- elf/dl-load.c | 1 + 1 file changed, 1 insertion(+) diff --git a/elf/dl-load.c b/elf/dl-load.c index 016a99c..c1e69b8 100644 --- a/elf/dl-load.c +++ b/elf/dl-load.c @@ -429,6 +429,7 @@ add_name_to_object (struct link_map *l, const char *name) newname->name = memcpy (newname + 1, name, name_len); newname->next = NULL; newname->dont_free = 0; + atomic_write_barrier (); lastp->next = newname; }