diff options
| author | Maninder Singh <maninder1.s@samsung.com> | 2018-01-10 15:17:30 +0000 |
|---|---|---|
| committer | Szabolcs Nagy <szabolcs.nagy@arm.com> | 2021-04-06 14:44:09 +0100 |
| commit | 395be7c2184645320c955b0ba214af9fa1ea9675 (patch) | |
| tree | dd3d5623c2fbf20dcae590efcfdfa58c6f48dc34 /elf/dl-misc.c | |
| parent | 69499bb6eeb4f5d1b3502758208301d21042a783 (diff) | |
| download | glibc-395be7c2184645320c955b0ba214af9fa1ea9675.zip glibc-395be7c2184645320c955b0ba214af9fa1ea9675.tar.gz glibc-395be7c2184645320c955b0ba214af9fa1ea9675.tar.bz2 | |
elf: Fix data race in _dl_name_match_p [BZ #21349]
dlopen updates libname_list by writing to lastp->next, but concurrent
reads in _dl_name_match_p were not synchronized when it was called
without holding GL(dl_load_lock), which can happen during lazy symbol
resolution.
This patch fixes the race between _dl_name_match_p reading lastp->next
and add_name_to_object writing to it. This could cause segfault on
targets with weak memory order when lastp->next->name is read, which
was observed on an arm system. Fixes bug 21349.
(Code is from Maninder Singh, comments and description is from Szabolcs
Nagy.)
Co-authored-by: Vaneet Narang <v.narang@samsung.com>
Co-authored-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Diffstat (limited to 'elf/dl-misc.c')
| -rw-r--r-- | elf/dl-misc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/elf/dl-misc.c b/elf/dl-misc.c index 082f75f..d4803bb 100644 --- a/elf/dl-misc.c +++ b/elf/dl-misc.c @@ -347,7 +347,9 @@ _dl_name_match_p (const char *name, const struct link_map *map) if (strcmp (name, runp->name) == 0) return 1; else - runp = runp->next; + /* Synchronize with the release MO store in add_name_to_object. + See CONCURRENCY NOTES in add_name_to_object in dl-load.c. */ + runp = atomic_load_acquire (&runp->next); return 0; } |