From: Hugues Bruant <hugues@aerofs.com>
To: musl@lists.openwall.com
Subject: dynlink.c: bug in reclaim_gaps leading to segfault in __libc_exit_fini
Date: Tue, 16 Feb 2016 16:30:42 -0500 [thread overview]
Message-ID: <CA+bHwpqotJLA7_hu1S1ZR9rNRk=Qegij98TQracYwizWe+g4BA@mail.gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 2656 bytes --]
Affects both 1.1.12 and 1.1.13
Tracked down with valgrind in Alpine Linux 3.3.
The dmg tool build from https://github.com/aerofs/libdmg-hfsplus links to a
handful shared libs. The following message is seen immediately at start:
==59== Invalid free() / delete / delete[] / realloc()
==59== at 0x4C92B0E: free (vg_replace_malloc.c:530)
==59== by 0x4056F68: reclaim_gaps (dynlink.c:488)
==59== by 0x405743D: map_library (dynlink.c:708)
==59== by 0x4057EF3: load_library (dynlink.c:1014)
==59== by 0x4058CA8: load_preload (dynlink.c:1112)
==59== by 0x4058CA8: __dls3 (dynlink.c:1581)
==59== by 0x405856A: __dls2 (dynlink.c:1383)
==59== by 0x405655E: ??? (in /lib/ld-musl-x86_64.so.1)
==59== by 0x3: ???
==59== by 0xFFF000E3A: ???
==59== by 0xFFF000E3E: ???
==59== by 0xFFF000E44: ???
==59== by 0xFFF000E86: ???
Afterwards, the program proceeds with no issue, until it exists, at which
point a segfault is triggered when cleaning up shared libraries:
==38== Invalid read of size 8
==38== at 0x4057551: decode_vec.constprop.5 (dynlink.c:171)
==38== by 0x405825C: __libc_exit_fini (dynlink.c:1197)
==38== by 0x4016233: exit (exit.c:31)
==38== by 0x401D635: (below main) (__libc_start_main.c:74)
==38== Address 0x636f8f53ebff9f53 is not stack'd, malloc'd or (recently) free'd
==38==
==38==
==38== Process terminating with default action of signal 11 (SIGSEGV)
==38== General Protection Fault
==38== at 0x4057551: decode_vec.constprop.5 (dynlink.c:171)
==38== by 0x405825C: __libc_exit_fini (dynlink.c:1197)
==38== by 0x4016233: exit (exit.c:31)
==38== by 0x401D635: (below main) (__libc_start_main.c:74)
==38==
The first 32 bytes of one of the dso struct are manifestly corrupted.
Patching reclaim_gap as follows fixes the segfault:
diff --git a/ldso/dynlink.c b/ldso/dynlink.c
index 87f3b7f..f897dbd 100644
--- a/ldso/dynlink.c
+++ b/ldso/dynlink.c
@@ -484,9 +484,9 @@ static void reclaim_gaps(struct dso *dso)
for (; phcnt--; ph=(void *)((char *)ph+dso->phentsize)) {
if (ph->p_type!=PT_LOAD) continue;
if ((ph->p_flags&(PF_R|PF_W))!=(PF_R|PF_W)) continue;
- reclaim(dso, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr);
- reclaim(dso, ph->p_vaddr+ph->p_memsz,
- ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE);
+ //reclaim(dso, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr);
+ //reclaim(dso, ph->p_vaddr+ph->p_memsz,
+ // ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE);
}
}
For more details: https://bugs.alpinelinux.org/issues/5123
Regards,
Hugues
[-- Attachment #2: Type: text/html, Size: 3606 bytes --]
next reply other threads:[~2016-02-16 21:30 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-02-16 21:30 Hugues Bruant [this message]
2016-02-16 21:55 ` Szabolcs Nagy
2016-02-16 22:02 ` Rich Felker
2016-02-17 0:05 ` Hugues Bruant
2016-02-17 0:21 ` Rich Felker
2016-02-17 6:16 ` Hugues Bruant
2016-02-17 6:27 ` Hugues Bruant
2016-02-17 7:03 ` Timo Teras
2016-02-17 9:15 ` Hugues Bruant
2016-02-17 15:25 ` Rich Felker
2016-02-17 17:34 ` Hugues Bruant
2016-02-17 18:14 ` Szabolcs Nagy
2016-02-17 18:46 ` Isaac Dunham
2016-02-17 10:19 ` Szabolcs Nagy
2016-02-18 18:05 ` Szabolcs Nagy
2016-02-18 18:33 ` Rich Felker
2016-02-17 15:17 ` Markus Wichmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CA+bHwpqotJLA7_hu1S1ZR9rNRk=Qegij98TQracYwizWe+g4BA@mail.gmail.com' \
--to=hugues@aerofs.com \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).