Don't deadlock in __dl_iterate_phdr while (un)loading objects.

diff --git a/ChangeLog b/ChangeLog
index ad1d327e12c113f0342608da6e1ff5986bed5a59..4005fc82c5845558138fe148f89097f2b245770f 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,16 @@
+2010-02-02  Andreas Schwab  <schwab@redhat.com>
+
+       * sysdeps/generic/ldsodefs.h (struct rtld_global): Add
+       _dl_load_write_lock.
+       * elf/rtld.c (_rtld_global): Initialize it.
+       * elf/dl-support.c (_dl_load_write_lock): Define .
+       * elf/dl-close.c (_dl_close_worker): Lock GL(dl_load_write_lock)
+       when modifying the list of loaded objects.
+       * elf/dl-load.c (lose): Likewise.
+       * elf/dl-object.c (_dl_new_object): Likewise.
+       * elf/dl-iteratephdr.c (__dl_iterate_phdr): Lock
+       GL(dl_load_write_lock) instead of GL(dl_load_lock).
+
 2010-05-03  Ulrich Drepper  <drepper@redhat.com>
 
        * elf/dl-iteratephdr.c (__dl_iterate_phdr): Remove unnecessary

diff --git a/elf/dl-close.c b/elf/dl-close.c
index b73a7adb1a1d54869aa517045e32ee329adf241e..700e765c3c3e78f89b9016a83919dc3dd8bb8177 100644 (file)
--- a/elf/dl-close.c
+++ b/elf/dl-close.c
@@ -507,6 +507,9 @@ _dl_close_worker (struct link_map *map)
   size_t tls_free_end;
   tls_free_start = tls_free_end = NO_TLS_OFFSET;
 
+  /* We modify the list of loaded objects.  */
+  __rtld_lock_lock_recursive (GL(dl_load_write_lock));
+
   /* Check each element of the search list to see if all references to
      it are gone.  */
   for (unsigned int i = first_loaded; i < nloaded; ++i)
@@ -665,6 +668,8 @@ _dl_close_worker (struct link_map *map)
        }
     }
 
+  __rtld_lock_unlock_recursive (GL(dl_load_write_lock));
+
   /* If we removed any object which uses TLS bump the generation counter.  */
   if (any_tls)
     {

diff --git a/elf/dl-iteratephdr.c b/elf/dl-iteratephdr.c
index 44864c1b7a103f610713b6d386659e10cdb88694..5f1c20d7557fd0d4d610e8b604402a2ae75c0109 100644 (file)
--- a/elf/dl-iteratephdr.c
+++ b/elf/dl-iteratephdr.c
@@ -26,7 +26,7 @@
 static void
 cancel_handler (void *arg __attribute__((unused)))
 {
-  __rtld_lock_unlock_recursive (GL(dl_load_lock));
+  __rtld_lock_unlock_recursive (GL(dl_load_write_lock));
 }
 
 hidden_proto (__dl_iterate_phdr)
@@ -38,8 +38,8 @@ __dl_iterate_phdr (int (*callback) (struct dl_phdr_info *info,
   struct dl_phdr_info info;
   int ret = 0;
 
-  /* Make sure we are alone.  */
-  __rtld_lock_lock_recursive (GL(dl_load_lock));
+  /* Make sure nobody modifies the list of loaded objects.  */
+  __rtld_lock_lock_recursive (GL(dl_load_write_lock));
   __libc_cleanup_push (cancel_handler, 0);
 
   /* We have to determine the namespace of the caller since this determines
@@ -79,7 +79,7 @@ __dl_iterate_phdr (int (*callback) (struct dl_phdr_info *info,
 
   /* Release the lock.  */
   __libc_cleanup_pop (0);
-  __rtld_lock_unlock_recursive (GL(dl_load_lock));
+  __rtld_lock_unlock_recursive (GL(dl_load_write_lock));
 
   return ret;
 }

diff --git a/elf/dl-load.c b/elf/dl-load.c
index d8f9131dd6bc78d70be3ebf9cf8e0c3a6aac13f8..0adddf5aaa2008c5c2ee91fd4b96489605581baa 100644 (file)
--- a/elf/dl-load.c
+++ b/elf/dl-load.c
@@ -803,6 +803,8 @@ lose (int code, int fd, const char *name, char *realname, struct link_map *l,
     (void) __close (fd);
   if (l != NULL)
     {
+      /* We modify the list of loaded objects.  */
+      __rtld_lock_lock_recursive (GL(dl_load_write_lock));
       /* Remove the stillborn object from the list and free it.  */
       assert (l->l_next == NULL);
       if (l->l_prev == NULL)
@@ -813,6 +815,7 @@ lose (int code, int fd, const char *name, char *realname, struct link_map *l,
        l->l_prev->l_next = NULL;
       --GL(dl_ns)[l->l_ns]._ns_nloaded;
       free (l);
+      __rtld_lock_unlock_recursive (GL(dl_load_write_lock));
     }
   free (realname);
 

diff --git a/elf/dl-object.c b/elf/dl-object.c
index 788e2c07b9174bd395557b4b221ae97279d55489..22a163560b48b3fb6b3a12112f470e550497908f 100644 (file)
--- a/elf/dl-object.c
+++ b/elf/dl-object.c
@@ -93,6 +93,9 @@ _dl_new_object (char *realname, const char *libname, int type,
   new->l_scope = new->l_scope_mem;
   new->l_scope_max = sizeof (new->l_scope_mem) / sizeof (new->l_scope_mem[0]);
 
+  /* We modify the list of loaded objects.  */
+  __rtld_lock_lock_recursive (GL(dl_load_write_lock));
+
   /* Counter for the scopes we have to handle.  */
   idx = 0;
 
@@ -114,6 +117,8 @@ _dl_new_object (char *realname, const char *libname, int type,
   new->l_serial = GL(dl_load_adds);
   ++GL(dl_load_adds);
 
+  __rtld_lock_unlock_recursive (GL(dl_load_write_lock));
+
   /* If we have no loader the new object acts as it.  */
   if (loader == NULL)
     loader = new;

diff --git a/elf/dl-support.c b/elf/dl-support.c
index 65b25750ded35b918dee98eb88a71fbcf75737f7..f94d2c4c6e0e095755a53eed217a361b7b6e9806 100644 (file)
--- a/elf/dl-support.c
+++ b/elf/dl-support.c
@@ -166,6 +166,10 @@ const ElfW(Ehdr) *_dl_sysinfo_dso;
    the loaded object might as well require a call to this function.
    At this time it is not anymore a problem to modify the tables.  */
 __rtld_lock_define_initialized_recursive (, _dl_load_lock)
+/* This lock is used to keep __dl_iterate_phdr from inspecting the
+   list of loaded objects while an object is added to or removed from
+   that list.  */
+__rtld_lock_define_initialized_recursive (, _dl_load_write_lock)
 
 
 #ifdef HAVE_AUX_VECTOR

diff --git a/elf/rtld.c b/elf/rtld.c
index e26b2b9e1bbdc21d3f71c6ac60e1f380784dadc6..90f3ff126eb910fa90f6361726fec97c1370fc85 100644 (file)
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -126,6 +126,7 @@ struct rtld_global _rtld_global =
     ._dl_stack_flags = PF_R|PF_W|PF_X,
 #ifdef _LIBC_REENTRANT
     ._dl_load_lock = _RTLD_LOCK_RECURSIVE_INITIALIZER,
+    ._dl_load_write_lock = _RTLD_LOCK_RECURSIVE_INITIALIZER,
 #endif
     ._dl_nns = 1,
     ._dl_ns =

diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index a14e8af92f41dae141f06543c733e205908dd81d..fcc943bce3aa95317d6ffb8a1d5a24174958e8ca 100644 (file)
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -416,6 +416,10 @@ struct rtld_global
      the loaded object might as well require a call to this function.
      At this time it is not anymore a problem to modify the tables.  */
   __rtld_lock_define_recursive (EXTERN, _dl_load_lock)
+  /* This lock is used to keep __dl_iterate_phdr from inspecting the
+     list of loaded objects while an object is added to or removed
+     from that list.  */
+  __rtld_lock_define_recursive (EXTERN, _dl_load_write_lock)
 
   /* Incremented whenever something may have been added to dl_loaded.  */
   EXTERN unsigned long long _dl_load_adds;