Bug 15686 - Shared-object static constructors called with a lock held
Summary: Shared-object static constructors called with a lock held
Status: NEW
Alias: None
Product: glibc
Classification: Unclassified
Component: dynamic-link (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
: 19448 (view as bug list)
Depends on:
Blocks:
 
Reported: 2013-06-26 22:43 UTC by Maciej W. Rozycki
Modified: 2021-09-21 13:21 UTC (History)
6 users (show)

See Also:
Host:
Target: *-*-*
Build:
Last reconfirmed:
fweimer: security-

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Maciej W. Rozycki 2013-06-26 22:43:09 UTC 
Shared-object static constructors are user code that the C library has no
control of.  They are called with the GL(dl_load_lock) lock held and are
therefore prone to a deadlock if they call back into the wrong part of
ld.so.  The exact call sequence is:

_dl_open -> dl_open_worker -> _dl_init -> call_init -> user code

and in the sequence above _dl_open takes the GL(dl_load_lock) lock before
calling dl_open_worker.  This affects all targets.

See also:

http://sourceware.org/ml/libc-alpha/2013-06/msg00802.html
http://sourceware.org/ml/libc-alpha/2013-06/msg00828.html
Comment 1 Florian Weimer 2017-03-10 18:29:35 UTC 
*** Bug 19448 has been marked as a duplicate of this bug. ***
Comment 2 Carlos O'Donell 2017-10-04 20:37:55 UTC 
This is normally not a problem except when constructors spawn threads to do additional work, which seems like a scenario we might support. In order to support it we would have to quiesce the state of the loader, release the locks, and run the constructor. This is something we have never supported before, but could in the future.
Comment 3 Szabolcs Nagy 2021-09-13 12:41:58 UTC 
note: deadlock can happen without thread creation from ctors:

thread 1: dlopen -> dl_load_lock -> ctor -> user_lock

thread 2: user_lock -> dlsym/dlopen/dlclose -> dl_load_lock


if calling dlsym/dlopen/dlclose/.. from a ctor is allowed
then i'd expect this to work too, but now it deadlocks.

the fix for bug 19329 added the same lock to pthread_create
so now this problem affects more code.
Comment 4 Szabolcs Nagy 2021-09-21 13:21:17 UTC 
i opened bug 28357 for the deadlock with pthread_create.