From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/9337 Path: news.gmane.org!not-for-mail From: Szabolcs Nagy Newsgroups: gmane.linux.lib.musl.general Subject: Re: dynlink.c: bug in reclaim_gaps leading to segfault in __libc_exit_fini Date: Tue, 16 Feb 2016 22:55:50 +0100 Message-ID: <20160216215550.GC9915@port70.net> References: Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1455659769 20995 80.91.229.3 (16 Feb 2016 21:56:09 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Tue, 16 Feb 2016 21:56:09 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-9350-gllmg-musl=m.gmane.org@lists.openwall.com Tue Feb 16 22:56:05 2016 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1aVnbJ-0007DS-Dz for gllmg-musl@m.gmane.org; Tue, 16 Feb 2016 22:56:05 +0100 Original-Received: (qmail 11571 invoked by uid 550); 16 Feb 2016 21:56:02 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 11547 invoked from network); 16 Feb 2016 21:56:02 -0000 Mail-Followup-To: musl@lists.openwall.com Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Xref: news.gmane.org gmane.linux.lib.musl.general:9337 Archived-At: * Hugues Bruant [2016-02-16 16:30:42 -0500]: > Affects both 1.1.12 and 1.1.13 > > Tracked down with valgrind in Alpine Linux 3.3. > > The dmg tool build from https://github.com/aerofs/libdmg-hfsplus links to a > handful shared libs. The following message is seen immediately at start: > > ==59== Invalid free() / delete / delete[] / realloc() > ==59== at 0x4C92B0E: free (vg_replace_malloc.c:530) > ==59== by 0x4056F68: reclaim_gaps (dynlink.c:488) > ==59== by 0x405743D: map_library (dynlink.c:708) > ==59== by 0x4057EF3: load_library (dynlink.c:1014) > ==59== by 0x4058CA8: load_preload (dynlink.c:1112) > ==59== by 0x4058CA8: __dls3 (dynlink.c:1581) > ==59== by 0x405856A: __dls2 (dynlink.c:1383) > ==59== by 0x405655E: ??? (in /lib/ld-musl-x86_64.so.1) > ==59== by 0x3: ??? > ==59== by 0xFFF000E3A: ??? > ==59== by 0xFFF000E3E: ??? > ==59== by 0xFFF000E44: ??? > ==59== by 0xFFF000E86: ??? > > Afterwards, the program proceeds with no issue, until it exists, at which > point a segfault is triggered when cleaning up shared libraries: > this is not a bug. valgrind is not aware of dynamic linker internals, you have to use a musl specific suppression file to hide this message (but i dont know if anybody wrote such thing for valgrind). > ==38== Invalid read of size 8 > ==38== at 0x4057551: decode_vec.constprop.5 (dynlink.c:171) > ==38== by 0x405825C: __libc_exit_fini (dynlink.c:1197) > ==38== by 0x4016233: exit (exit.c:31) > ==38== by 0x401D635: (below main) (__libc_start_main.c:74) > ==38== Address 0x636f8f53ebff9f53 is not stack'd, malloc'd or (recently) free'd > ==38== > ==38== > ==38== Process terminating with default action of signal 11 (SIGSEGV) > ==38== General Protection Fault > ==38== at 0x4057551: decode_vec.constprop.5 (dynlink.c:171) > ==38== by 0x405825C: __libc_exit_fini (dynlink.c:1197) > ==38== by 0x4016233: exit (exit.c:31) > ==38== by 0x401D635: (below main) (__libc_start_main.c:74) > ==38== > > > The first 32 bytes of one of the dso struct are manifestly corrupted. > > Patching reclaim_gap as follows fixes the segfault: > there is a corruption, but it is not caused by reclaim gaps, removing it just hides the problem (becaues then early mallocs happen to go elsewhere where they are not corrupted). needs more investigation. > diff --git a/ldso/dynlink.c b/ldso/dynlink.c > index 87f3b7f..f897dbd 100644 > --- a/ldso/dynlink.c > +++ b/ldso/dynlink.c > @@ -484,9 +484,9 @@ static void reclaim_gaps(struct dso *dso) > for (; phcnt--; ph=(void *)((char *)ph+dso->phentsize)) { > if (ph->p_type!=PT_LOAD) continue; > if ((ph->p_flags&(PF_R|PF_W))!=(PF_R|PF_W)) continue; > - reclaim(dso, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr); > - reclaim(dso, ph->p_vaddr+ph->p_memsz, > - ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE); > + //reclaim(dso, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr); > + //reclaim(dso, ph->p_vaddr+ph->p_memsz, > + // ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE); > } > } > > > For more details: https://bugs.alpinelinux.org/issues/5123 > > Regards, > Hugues