malloc: Set and reset all hooks for tracing (Bug 16573)

If an error occurs during the tracing operation, particularly during a
call to lock_and_info() which calls _dl_addr, we may end up calling back
into the malloc-subsystem and relock the loader lock and deadlock. For
all intents and purposes the call to _dl_addr can call any of the malloc
family API functions and so we should disable all tracing before calling
such loader functions.  This is similar to the strategy that the new
malloc tracer takes when calling the real malloc, namely that all
tracing ceases at the boundary to the real function and any faults at
that point are the purvue of the library (though the new tracer does
this on a per-thread basis in an MT-safe fashion). Since the new tracer
and the hook deprecation are not yet complete we must fix these issues
where we can.

Tested on x86_64 with no regressions.

Co-authored-by: Kwok Cheung Yeung <kcy@codesourcery.com>
Reviewed-by: DJ Delorie <dj@redhat.com>
(cherry picked from commit e621246ec6393ea08ae50310f9d5e72500f8c9bc)

diff --git a/ChangeLog b/ChangeLog
index 3b5d24cf675bd11d0ad695859e4110e757195d93..077d0dae29f67cc1604286118b35f25aa5ab89af 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,18 @@
+2019-04-09  Carlos O'Donell  <carlos@redhat.com>
+           Kwok Cheung Yeung  <kcy@codesourcery.com>
+
+       [BZ #16573]
+       * malloc/mtrace.c: Define prototypes for all hooks.
+       (set_default_hooks): New function.
+       (set_trace_hooks): Likewise.
+       (save_default_hooks): Likewise.
+       (tr_freehook): Use new s*_hooks functions.
+       (tr_mallochook): Likewise.
+       (tr_reallochook): Likewise.
+       (tr_memalignhook): Likewise.
+       (mtrace): Likewise.
+       (muntrace): Likewise.
+
 2019-04-02  TAMUKI Shoichi  <tamuki@linet.gr.jp>
 
        [BZ #22964]

diff --git a/NEWS b/NEWS
index 703864ac753b32b011dd9fdc6c4202de2e7f26b8..117646df7bd375e6d6713316f52d5e9d4c0ab9f3 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,7 @@ Major new features:
 
 The following bugs are resolved with this release:
 
+  [16573] malloc: Set and reset all hooks for tracing
   [24155] x32 memcmp can treat positive length as 0 (if sign bit in RDX is set) (CVE-2019-7309)
   [24164] Systemtap probes need to use "nr" constraint on 32-bit Arm
   [24161] __run_fork_handlers self-deadlocks in malloc/tst-mallocfork2

diff --git a/malloc/mtrace.c b/malloc/mtrace.c
index a2facf65ea3f558e0df5cee06d06ecc7cffb7105..2fda2625084270a1e75d8901ee8bd83f53d8806d 100644 (file)
--- a/malloc/mtrace.c
+++ b/malloc/mtrace.c
@@ -121,6 +121,41 @@ lock_and_info (const void *caller, Dl_info *mem)
   return res;
 }
 
+static void tr_freehook (void *, const void *);
+static void * tr_mallochook (size_t, const void *);
+static void * tr_reallochook (void *, size_t, const void *);
+static void * tr_memalignhook (size_t, size_t, const void *);
+
+/* Set all the default non-trace hooks.  */
+static __always_inline void
+set_default_hooks (void)
+{
+  __free_hook = tr_old_free_hook;
+  __malloc_hook = tr_old_malloc_hook;
+  __realloc_hook = tr_old_realloc_hook;
+  __memalign_hook = tr_old_memalign_hook;
+}
+
+/* Set all of the tracing hooks used for mtrace.  */
+static __always_inline void
+set_trace_hooks (void)
+{
+  __free_hook = tr_freehook;
+  __malloc_hook = tr_mallochook;
+  __realloc_hook = tr_reallochook;
+  __memalign_hook = tr_memalignhook;
+}
+
+/* Save the current set of hooks as the default hooks.  */
+static __always_inline void
+save_default_hooks (void)
+{
+  tr_old_free_hook = __free_hook;
+  tr_old_malloc_hook = __malloc_hook;
+  tr_old_realloc_hook = __realloc_hook;
+  tr_old_memalign_hook = __memalign_hook;
+}
+
 static void
 tr_freehook (void *ptr, const void *caller)
 {
@@ -138,12 +173,12 @@ tr_freehook (void *ptr, const void *caller)
       tr_break ();
       __libc_lock_lock (lock);
     }
-  __free_hook = tr_old_free_hook;
+  set_default_hooks ();
   if (tr_old_free_hook != NULL)
     (*tr_old_free_hook)(ptr, caller);
   else
     free (ptr);
-  __free_hook = tr_freehook;
+  set_trace_hooks ();
   __libc_lock_unlock (lock);
 }
 
@@ -155,12 +190,12 @@ tr_mallochook (size_t size, const void *caller)
   Dl_info mem;
   Dl_info *info = lock_and_info (caller, &mem);
 
-  __malloc_hook = tr_old_malloc_hook;
+  set_default_hooks ();
   if (tr_old_malloc_hook != NULL)
     hdr = (void *) (*tr_old_malloc_hook)(size, caller);
   else
     hdr = (void *) malloc (size);
-  __malloc_hook = tr_mallochook;
+  set_trace_hooks ();
 
   tr_where (caller, info);
   /* We could be printing a NULL here; that's OK.  */
@@ -185,16 +220,12 @@ tr_reallochook (void *ptr, size_t size, const void *caller)
   Dl_info mem;
   Dl_info *info = lock_and_info (caller, &mem);
 
-  __free_hook = tr_old_free_hook;
-  __malloc_hook = tr_old_malloc_hook;
-  __realloc_hook = tr_old_realloc_hook;
+  set_default_hooks ();
   if (tr_old_realloc_hook != NULL)
     hdr = (void *) (*tr_old_realloc_hook)(ptr, size, caller);
   else
     hdr = (void *) realloc (ptr, size);
-  __free_hook = tr_freehook;
-  __malloc_hook = tr_mallochook;
-  __realloc_hook = tr_reallochook;
+  set_trace_hooks ();
 
   tr_where (caller, info);
   if (hdr == NULL)
@@ -230,14 +261,12 @@ tr_memalignhook (size_t alignment, size_t size, const void *caller)
   Dl_info mem;
   Dl_info *info = lock_and_info (caller, &mem);
 
-  __memalign_hook = tr_old_memalign_hook;
-  __malloc_hook = tr_old_malloc_hook;
+  set_default_hooks ();
   if (tr_old_memalign_hook != NULL)
     hdr = (void *) (*tr_old_memalign_hook)(alignment, size, caller);
   else
     hdr = (void *) memalign (alignment, size);
-  __memalign_hook = tr_memalignhook;
-  __malloc_hook = tr_mallochook;
+  set_trace_hooks ();
 
   tr_where (caller, info);
   /* We could be printing a NULL here; that's OK.  */
@@ -305,14 +334,8 @@ mtrace (void)
           malloc_trace_buffer = mtb;
           setvbuf (mallstream, malloc_trace_buffer, _IOFBF, TRACE_BUFFER_SIZE);
           fprintf (mallstream, "= Start\n");
-          tr_old_free_hook = __free_hook;
-          __free_hook = tr_freehook;
-          tr_old_malloc_hook = __malloc_hook;
-          __malloc_hook = tr_mallochook;
-          tr_old_realloc_hook = __realloc_hook;
-          __realloc_hook = tr_reallochook;
-          tr_old_memalign_hook = __memalign_hook;
-          __memalign_hook = tr_memalignhook;
+         save_default_hooks ();
+         set_trace_hooks ();
 #ifdef _LIBC
           if (!added_atexit_handler)
             {
@@ -338,10 +361,7 @@ muntrace (void)
      file.  */
   FILE *f = mallstream;
   mallstream = NULL;
-  __free_hook = tr_old_free_hook;
-  __malloc_hook = tr_old_malloc_hook;
-  __realloc_hook = tr_old_realloc_hook;
-  __memalign_hook = tr_old_memalign_hook;
+  set_default_hooks ();
 
   fprintf (f, "= End\n");
   fclose (f);