From Jaroslav.Suchanek@avg.com  Mon Aug  9 08:10:03 2010
Return-Path: <Jaroslav.Suchanek@avg.com>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 0E87E1065675
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  9 Aug 2010 08:10:03 +0000 (UTC)
	(envelope-from Jaroslav.Suchanek@avg.com)
Received: from ms.grisoft.cz (ms.avg.com [193.85.188.248])
	by mx1.freebsd.org (Postfix) with ESMTP id B5C8B8FC1A
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  9 Aug 2010 08:10:02 +0000 (UTC)
Received: from deimos.cz.avg.com (unknown [192.168.200.161])
	(using TLSv1 with cipher AES128-SHA (128/128 bits))
	(No client certificate requested)
	by ms.grisoft.cz (Postfix) with ESMTP id D2E433824A
	for <FreeBSD-gnats-submit@freebsd.org>; Mon,  9 Aug 2010 09:59:01 +0200 (CEST)
Received: from jardas.grisoft.cz (192.168.200.87) by mail.cz.avg.com
 (192.168.200.162) with Microsoft SMTP Server (TLS) id 8.3.83.0; Mon, 9 Aug
 2010 09:59:01 +0200
Received: from jardas.grisoft.cz (localhost [127.0.0.1])	by jardas.grisoft.cz
 (8.14.4/8.14.3) with ESMTP id o797wn9v001529	for
 <FreeBSD-gnats-submit@freebsd.org>; Mon, 9 Aug 2010 09:58:49 +0200 (CEST)
	(envelope-from jarda@jardas.grisoft.cz)
Received: (from jarda@localhost)	by jardas.grisoft.cz (8.14.4/8.14.4/Submit)
 id o797wnFm001528;	Mon, 9 Aug 2010 09:58:49 +0200 (CEST)	(envelope-from
 jarda)
Message-Id: <201008090758.o797wnFm001528@jardas.grisoft.cz>
Date: Mon, 9 Aug 2010 09:58:49 +0200
From: <jaroslav.suchanek@avg.com>
Reply-To: jaroslav.suchanek@avg.com
To: <FreeBSD-gnats-submit@freebsd.org>
Cc:
Subject: dlclose can access freed memory and crash
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         149464
>Category:       bin
>Synopsis:       [libc] [rtld] dlclose(3) can access freed memory and crash
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    jh
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Aug 09 08:20:07 UTC 2010
>Closed-Date:    Tue Feb 07 18:04:17 UTC 2012
>Last-Modified:  Tue Feb 07 18:04:17 UTC 2012
>Originator:     Jaroslav Suchanek
>Release:        FreeBSD 8.0-RELEASE-p2 amd64
>Organization:
>Environment:
System: FreeBSD jardas.grisoft.cz 8.0-RELEASE-p2 FreeBSD 8.0-RELEASE-p2 #3: Mon Mar 1 12:02:47 CET 2010 root@jardas.grisoft.cz:/usr/obj/usr/src/sys/JSKERNEL amd64


>Description:
	This might be related to pr bin/42397. Consider this situation:
	- a binary loads two shared libraries A and B via dlopen()
	- both A and B loads shared library C via dlopen()
	- the binary calls dlclose on A. While unloading A the reference
	count of C is correctly decreased
	- the binary calls dlclose on B and crash occurs. The C is correctly
	unmapped though
>How-To-Repeat:
	Run the attached test case.
>Fix:
	I don't know yet.


>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->secteam 
Responsible-Changed-By: remko 
Responsible-Changed-When: Sun Aug 29 14:12:34 UTC 2010 
Responsible-Changed-Why:  
For review / check to secteam 

http://www.freebsd.org/cgi/query-pr.cgi?pr=149464 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/149464: commit references a PR
Date: Thu, 16 Dec 2010 16:56:49 +0000 (UTC)

 Author: jh
 Date: Thu Dec 16 16:56:44 2010
 New Revision: 216489
 URL: http://svn.freebsd.org/changeset/base/216489
 
 Log:
   If dlclose() is called recursively from a _fini() function, the inner
   dlclose() call may unload the object of the outer call prematurely
   because objects are unreferenced before _fini() calls.
   
   Fix this by unreferencing objects after calling objlist_call_fini() in
   dlclose(). Therefore objlist_call_fini() now calls the fini function if
   the reference count of an object is 1. In addition we must restart the
   list_fini traversal after every _fini() call because another dlclose()
   call might have modified the reference counts.
   
   Add an XXX comment to objlist_call_fini() about possible race with
   dlopen().
   
   PR:		133246, 149464
   Reviewed by:	kan, kib
 
 Modified:
   head/libexec/rtld-elf/rtld.c
 
 Modified: head/libexec/rtld-elf/rtld.c
 ==============================================================================
 --- head/libexec/rtld-elf/rtld.c	Thu Dec 16 16:55:22 2010	(r216488)
 +++ head/libexec/rtld-elf/rtld.c	Thu Dec 16 16:56:44 2010	(r216489)
 @@ -110,7 +110,7 @@ static int load_needed_objects(Obj_Entry
  static int load_preload_objects(void);
  static Obj_Entry *load_object(const char *, const Obj_Entry *, int);
  static Obj_Entry *obj_from_addr(const void *);
 -static void objlist_call_fini(Objlist *, bool, int *);
 +static void objlist_call_fini(Objlist *, Obj_Entry *, int *);
  static void objlist_call_init(Objlist *, int *);
  static void objlist_clear(Objlist *);
  static Objlist_Entry *objlist_find(Objlist *, const Obj_Entry *);
 @@ -1609,36 +1609,56 @@ obj_from_addr(const void *addr)
  
  /*
   * Call the finalization functions for each of the objects in "list"
 - * which are unreferenced.  All of the objects are expected to have
 - * non-NULL fini functions.
 + * belonging to the DAG of "root" and referenced once. If NULL "root"
 + * is specified, every finalization function will be called regardless
 + * of the reference count and the list elements won't be freed. All of
 + * the objects are expected to have non-NULL fini functions.
   */
  static void
 -objlist_call_fini(Objlist *list, bool force, int *lockstate)
 +objlist_call_fini(Objlist *list, Obj_Entry *root, int *lockstate)
  {
 -    Objlist_Entry *elm, *elm_tmp;
 +    Objlist_Entry *elm;
      char *saved_msg;
  
 +    assert(root == NULL || root->refcount == 1);
 +
      /*
       * Preserve the current error message since a fini function might
       * call into the dynamic linker and overwrite it.
       */
      saved_msg = errmsg_save();
 -    STAILQ_FOREACH_SAFE(elm, list, link, elm_tmp) {
 -	if (elm->obj->refcount == 0 || force) {
 +    do {
 +	STAILQ_FOREACH(elm, list, link) {
 +	    if (root != NULL && (elm->obj->refcount != 1 ||
 +	      objlist_find(&root->dagmembers, elm->obj) == NULL))
 +		continue;
  	    dbg("calling fini function for %s at %p", elm->obj->path,
  	        (void *)elm->obj->fini);
  	    LD_UTRACE(UTRACE_FINI_CALL, elm->obj, (void *)elm->obj->fini, 0, 0,
  		elm->obj->path);
  	    /* Remove object from fini list to prevent recursive invocation. */
  	    STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
 +	    /*
 +	     * XXX: If a dlopen() call references an object while the
 +	     * fini function is in progress, we might end up trying to
 +	     * unload the referenced object in dlclose() or the object
 +	     * won't be unloaded although its fini function has been
 +	     * called.
 +	     */
  	    wlock_release(rtld_bind_lock, *lockstate);
  	    call_initfini_pointer(elm->obj, elm->obj->fini);
  	    *lockstate = wlock_acquire(rtld_bind_lock);
  	    /* No need to free anything if process is going down. */
 -	    if (!force)
 +	    if (root != NULL)
  	    	free(elm);
 +	    /*
 +	     * We must restart the list traversal after every fini call
 +	     * because a dlclose() call from the fini function or from
 +	     * another thread might have modified the reference counts.
 +	     */
 +	    break;
  	}
 -    }
 +    } while (elm != NULL);
      errmsg_restore(saved_msg);
  }
  
 @@ -1826,7 +1846,7 @@ rtld_exit(void)
  
      lockstate = wlock_acquire(rtld_bind_lock);
      dbg("rtld_exit()");
 -    objlist_call_fini(&list_fini, true, &lockstate);
 +    objlist_call_fini(&list_fini, NULL, &lockstate);
      /* No need to remove the items from the list, since we are exiting. */
      if (!libmap_disable)
          lm_fini();
 @@ -1939,20 +1959,22 @@ dlclose(void *handle)
      /* Unreference the object and its dependencies. */
      root->dl_refcount--;
  
 -    unref_dag(root);
 -
 -    if (root->refcount == 0) {
 +    if (root->refcount == 1) {
  	/*
 -	 * The object is no longer referenced, so we must unload it.
 +	 * The object will be no longer referenced, so we must unload it.
  	 * First, call the fini functions.
  	 */
 -	objlist_call_fini(&list_fini, false, &lockstate);
 +	objlist_call_fini(&list_fini, root, &lockstate);
 +
 +	unref_dag(root);
  
  	/* Finish cleaning up the newly-unreferenced objects. */
  	GDB_STATE(RT_DELETE,&root->linkmap);
  	unload_object(root);
  	GDB_STATE(RT_CONSISTENT,NULL);
 -    }
 +    } else
 +	unref_dag(root);
 +
      LD_UTRACE(UTRACE_DLCLOSE_STOP, handle, NULL, 0, 0, NULL);
      wlock_release(rtld_bind_lock, lockstate);
      return 0;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: open->patched 
State-Changed-By: jh 
State-Changed-When: Sun Jan 2 11:38:48 UTC 2011 
State-Changed-Why:  
A patch to fix the problem with submitter provided test case has been 
committed. 


Responsible-Changed-From-To: secteam->jh 
Responsible-Changed-By: jh 
Responsible-Changed-When: Sun Jan 2 11:38:48 UTC 2011 
Responsible-Changed-Why:  
I committed the fix. 

Silence from:	remko, secteam 

http://www.freebsd.org/cgi/query-pr.cgi?pr=149464 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: bin/149464: commit references a PR
Date: Thu,  3 Mar 2011 17:12:43 +0000 (UTC)

 Author: jh
 Date: Thu Mar  3 17:12:24 2011
 New Revision: 219237
 URL: http://svn.freebsd.org/changeset/base/219237
 
 Log:
   MFC r216489:
   
   If dlclose() is called recursively from a _fini() function, the inner
   dlclose() call may unload the object of the outer call prematurely
   because objects are unreferenced before _fini() calls.
   
   Fix this by unreferencing objects after calling objlist_call_fini() in
   dlclose(). Therefore objlist_call_fini() now calls the fini function if
   the reference count of an object is 1. In addition we must restart the
   list_fini traversal after every _fini() call because another dlclose()
   call might have modified the reference counts.
   
   Add an XXX comment to objlist_call_fini() about possible race with
   dlopen().
   
   PR:		133246, 149464
 
 Modified:
   stable/8/libexec/rtld-elf/rtld.c
 Directory Properties:
   stable/8/libexec/rtld-elf/   (props changed)
 
 Modified: stable/8/libexec/rtld-elf/rtld.c
 ==============================================================================
 --- stable/8/libexec/rtld-elf/rtld.c	Thu Mar  3 17:11:11 2011	(r219236)
 +++ stable/8/libexec/rtld-elf/rtld.c	Thu Mar  3 17:12:24 2011	(r219237)
 @@ -107,7 +107,7 @@ static int load_needed_objects(Obj_Entry
  static int load_preload_objects(void);
  static Obj_Entry *load_object(const char *, const Obj_Entry *, int);
  static Obj_Entry *obj_from_addr(const void *);
 -static void objlist_call_fini(Objlist *, bool, int *);
 +static void objlist_call_fini(Objlist *, Obj_Entry *, int *);
  static void objlist_call_init(Objlist *, int *);
  static void objlist_clear(Objlist *);
  static Objlist_Entry *objlist_find(Objlist *, const Obj_Entry *);
 @@ -1616,36 +1616,56 @@ obj_from_addr(const void *addr)
  
  /*
   * Call the finalization functions for each of the objects in "list"
 - * which are unreferenced.  All of the objects are expected to have
 - * non-NULL fini functions.
 + * belonging to the DAG of "root" and referenced once. If NULL "root"
 + * is specified, every finalization function will be called regardless
 + * of the reference count and the list elements won't be freed. All of
 + * the objects are expected to have non-NULL fini functions.
   */
  static void
 -objlist_call_fini(Objlist *list, bool force, int *lockstate)
 +objlist_call_fini(Objlist *list, Obj_Entry *root, int *lockstate)
  {
 -    Objlist_Entry *elm, *elm_tmp;
 +    Objlist_Entry *elm;
      char *saved_msg;
  
 +    assert(root == NULL || root->refcount == 1);
 +
      /*
       * Preserve the current error message since a fini function might
       * call into the dynamic linker and overwrite it.
       */
      saved_msg = errmsg_save();
 -    STAILQ_FOREACH_SAFE(elm, list, link, elm_tmp) {
 -	if (elm->obj->refcount == 0 || force) {
 +    do {
 +	STAILQ_FOREACH(elm, list, link) {
 +	    if (root != NULL && (elm->obj->refcount != 1 ||
 +	      objlist_find(&root->dagmembers, elm->obj) == NULL))
 +		continue;
  	    dbg("calling fini function for %s at %p", elm->obj->path,
  	        (void *)elm->obj->fini);
  	    LD_UTRACE(UTRACE_FINI_CALL, elm->obj, (void *)elm->obj->fini, 0, 0,
  		elm->obj->path);
  	    /* Remove object from fini list to prevent recursive invocation. */
  	    STAILQ_REMOVE(list, elm, Struct_Objlist_Entry, link);
 +	    /*
 +	     * XXX: If a dlopen() call references an object while the
 +	     * fini function is in progress, we might end up trying to
 +	     * unload the referenced object in dlclose() or the object
 +	     * won't be unloaded although its fini function has been
 +	     * called.
 +	     */
  	    wlock_release(rtld_bind_lock, *lockstate);
  	    call_initfini_pointer(elm->obj, elm->obj->fini);
  	    *lockstate = wlock_acquire(rtld_bind_lock);
  	    /* No need to free anything if process is going down. */
 -	    if (!force)
 +	    if (root != NULL)
  	    	free(elm);
 +	    /*
 +	     * We must restart the list traversal after every fini call
 +	     * because a dlclose() call from the fini function or from
 +	     * another thread might have modified the reference counts.
 +	     */
 +	    break;
  	}
 -    }
 +    } while (elm != NULL);
      errmsg_restore(saved_msg);
  }
  
 @@ -1833,7 +1853,7 @@ rtld_exit(void)
  
      lockstate = wlock_acquire(rtld_bind_lock);
      dbg("rtld_exit()");
 -    objlist_call_fini(&list_fini, true, &lockstate);
 +    objlist_call_fini(&list_fini, NULL, &lockstate);
      /* No need to remove the items from the list, since we are exiting. */
      if (!libmap_disable)
          lm_fini();
 @@ -1946,20 +1966,22 @@ dlclose(void *handle)
      /* Unreference the object and its dependencies. */
      root->dl_refcount--;
  
 -    unref_dag(root);
 -
 -    if (root->refcount == 0) {
 +    if (root->refcount == 1) {
  	/*
 -	 * The object is no longer referenced, so we must unload it.
 +	 * The object will be no longer referenced, so we must unload it.
  	 * First, call the fini functions.
  	 */
 -	objlist_call_fini(&list_fini, false, &lockstate);
 +	objlist_call_fini(&list_fini, root, &lockstate);
 +
 +	unref_dag(root);
  
  	/* Finish cleaning up the newly-unreferenced objects. */
  	GDB_STATE(RT_DELETE,&root->linkmap);
  	unload_object(root);
  	GDB_STATE(RT_CONSISTENT,NULL);
 -    }
 +    } else
 +	unref_dag(root);
 +
      LD_UTRACE(UTRACE_DLCLOSE_STOP, handle, NULL, 0, 0, NULL);
      wlock_release(rtld_bind_lock, lockstate);
      return 0;
 _______________________________________________
 svn-src-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/svn-src-all
 To unsubscribe, send any mail to "svn-src-all-unsubscribe@freebsd.org"
 
State-Changed-From-To: patched->closed 
State-Changed-By: jh 
State-Changed-When: Tue Feb 7 18:04:15 UTC 2012 
State-Changed-Why:  
The fix is in head, stable/9 and stable/8. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=149464 
>Unformatted:
