From e5d262effe3a87164308a3f37e61b32d0348692a Mon Sep 17 00:00:00 2001 From: Tulio Magno Quites Machado Filho Date: Fri, 30 Nov 2018 18:05:32 -0200 Subject: Fix _dl_profile_fixup data-dependency issue (Bug 23690) There is a data-dependency between the fields of struct l_reloc_result and the field used as the initialization guard. Users of the guard expect writes to the structure to be observable when they also observe the guard initialized. The solution for this problem is to use an acquire and release load and store to ensure previous writes to the structure are observable if the guard is initialized. The previous implementation used DL_FIXUP_VALUE_ADDR (l_reloc_result->addr) as the initialization guard, making it impossible for some architectures to load and store it atomically, i.e. hppa and ia64, due to its larger size. This commit adds an unsigned int to l_reloc_result to be used as the new initialization guard of the struct, making it possible to load and store it atomically in all architectures. The fix ensures that the values observed in l_reloc_result are consistent and do not lead to crashes. The algorithm is documented in the code in elf/dl-runtime.c (_dl_profile_fixup). Not all data races have been eliminated. Tested with build-many-glibcs and on powerpc, powerpc64, and powerpc64le. [BZ #23690] * elf/dl-runtime.c (_dl_profile_fixup): Guarantee memory modification order when accessing reloc_result->addr. * include/link.h (reloc_result): Add field init. * nptl/Makefile (tests): Add tst-audit-threads. (modules-names): Add tst-audit-threads-mod1 and tst-audit-threads-mod2. Add rules to build tst-audit-threads. * nptl/tst-audit-threads-mod1.c: New file. * nptl/tst-audit-threads-mod2.c: Likewise. * nptl/tst-audit-threads.c: Likewise. * nptl/tst-audit-threads.h: Likewise. Signed-off-by: Tulio Magno Quites Machado Filho Reviewed-by: Carlos O'Donell --- include/link.h | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'include/link.h') diff --git a/include/link.h b/include/link.h index 5924594..83b1c34 100644 --- a/include/link.h +++ b/include/link.h @@ -216,6 +216,10 @@ struct link_map unsigned int boundndx; uint32_t enterexit; unsigned int flags; + /* CONCURRENCY NOTE: This is used to guard the concurrent initialization + of the relocation result across multiple threads. See the more + detailed notes in elf/dl-runtime.c. */ + unsigned int init; } *l_reloc_result; /* Pointer to the version information if available. */ -- cgit v1.1