Bug 20488 - dl_build_local_scope processes in depth first not breadth first
Summary: dl_build_local_scope processes in depth first not breadth first
Status: UNCONFIRMED
Alias: None
Product: glibc
Classification: Unclassified
Component: dynamic-link (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-08-18 20:14 UTC by Mark Hatle
Modified: 2022-02-08 18:22 UTC (History)
4 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments
Patch to fix the issue (816 bytes, patch)
2016-08-18 20:16 UTC, Mark Hatle
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Hatle 2016-08-18 20:14:18 UTC
The ELF specification indicates symbol resolution should be breadth first, not depth first.

The dl-deps.c: dl_build_locale_scope function is processing in a depth first mode.  This is causes certain symbols to be incorrectly reported when LD_TRACE_PRELINKING=1 is enabled.

In the 'cross' prelink emulated RTLD, we had a similar bug and fixed the issue.

glibc has the same problem.
Comment 1 Mark Hatle 2016-08-18 20:16:55 UTC
Created attachment 9456 [details]
Patch to fix the issue

Attached is a patch that fixes the issue.  This patch was independently developed by me.

Wind River (my employer) has a copyright assignment on file with the FSF that covers glibc.
Comment 2 Mark Hatle 2016-08-18 20:23:19 UTC
Yocto Project bug 9131 covers this issue: https://bugzilla.yoctoproject.org/show_bug.cgi?id=9131

This also appears to have been reported to the libc mailing list as well:

https://sourceware.org/ml/libc-alpha/2016-05/msg00034.html
Comment 3 richard.purdie 2022-02-03 15:18:25 UTC
FWIW if prelink is removed, this issue becomes obsolete as the code this fixes is  removed.
Comment 4 Emma Jane Bonestell 2022-02-08 15:24:36 UTC
(In reply to richard.purdie from comment #3)
> FWIW if prelink is removed, this issue becomes obsolete as the code this
> fixes is  removed.

That's kind of a useless tautology. Of course it's obsolete if it isn't used or is removed. 

I am always befuddled when bug reports are completely ignored when they have a succinct summation of issues, a clear violation occurring, and even provision of a fix. It would be nice to know why glibc has decided to be knowingly non-ELF compliant for at least 6 years, on a violation ongoing for at least 20 years ( http://www.sco.com/developers/gabi/latest/ch5.dynamic.html#shobj_dependencies 
 https://github.com/bminor/glibc/commit/32e6df3621edc5067dfd6e87a387e1751f67f708 ).
Comment 5 Adhemerval Zanella 2022-02-08 17:17:34 UTC
(In reply to Emma Jane Bonestell from comment #4)
> (In reply to richard.purdie from comment #3)
> > FWIW if prelink is removed, this issue becomes obsolete as the code this
> > fixes is  removed.
> 
> That's kind of a useless tautology. Of course it's obsolete if it isn't used
> or is removed. 
> 
> I am always befuddled when bug reports are completely ignored when they have
> a succinct summation of issues, a clear violation occurring, and even
> provision of a fix. It would be nice to know why glibc has decided to be
> knowingly non-ELF compliant for at least 6 years, on a violation ongoing for
> at least 20 years (
> http://www.sco.com/developers/gabi/latest/ch5.dynamic.
> html#shobj_dependencies 
>  https://github.com/bminor/glibc/commit/
> 32e6df3621edc5067dfd6e87a387e1751f67f708 ).

Mainly because if you have followed up the prelink discussion recently done on libc-alpha you would see this is a very rarely used feature, that requires additional setup to actually test is, and that has bitrotten due lack of maintanance. Also, prelink project itself is not activelly maintained, Joseph, for instance, noted that a fix for aarch64 was never incorporated on prelinking-ng repo.

Also, we have a limited volunters that is focused on diferent projects.
Comment 6 Emma Jane Bonestell 2022-02-08 17:56:04 UTC
(In reply to Adhemerval Zanella from comment #5)
> 
> Mainly because if you have followed up the prelink discussion recently done
> on libc-alpha you would see this is a very rarely used feature, that
> requires additional setup to actually test is, and that has bitrotten due
> lack of maintanance. Also, prelink project itself is not activelly
> maintained, Joseph, for instance, noted that a fix for aarch64 was never
> incorporated on prelinking-ng repo.
> 
> Also, we have a limited volunters that is focused on diferent projects.

I misunderstood that it has already been marked for removal. And yes, I do understand the nature of open source/free software, though that's why I limited it to when one has been essentially handed the solution. 

A bit disappointing as I've been tinkering with updating the SLINKY linker, etc., to work on newer kernels, and it fundamentally depends on preloading. I suppose patching back in preloading in addition to this patch won't be anymore annoying than it already was :) .
Comment 7 richard.purdie 2022-02-08 17:59:55 UTC
Note that prelinking and preloading are two different things.
Comment 8 Emma Jane Bonestell 2022-02-08 18:10:13 UTC
(In reply to richard.purdie from comment #7)
> Note that prelinking and preloading are two different things.

Yes, a mistake on my part. I did mean prelinking, not preloading, above.
Comment 9 Adhemerval Zanella 2022-02-08 18:22:40 UTC
(In reply to Emma Jane Bonestell from comment #6)
> (In reply to Adhemerval Zanella from comment #5)
> > 
> > Mainly because if you have followed up the prelink discussion recently done
> > on libc-alpha you would see this is a very rarely used feature, that
> > requires additional setup to actually test is, and that has bitrotten due
> > lack of maintanance. Also, prelink project itself is not activelly
> > maintained, Joseph, for instance, noted that a fix for aarch64 was never
> > incorporated on prelinking-ng repo.
> > 
> > Also, we have a limited volunters that is focused on diferent projects.
> 
> I misunderstood that it has already been marked for removal. And yes, I do
> understand the nature of open source/free software, though that's why I
> limited it to when one has been essentially handed the solution. 

I only have been aware of this issue when it was pinged on libc-alpha some weeks before 2.35 release and then I restarted the prelink discussion. It turned out that prelink support is in a worse condition than I expected [1][2], which make fixing this bug not really an useful (it would be used in a limited environment, and it would require additional work such tests and checking on some architectures).

[1] https://sourceware.org/pipermail/libc-alpha/2022-January/135520.html
[2] https://sourceware.org/pipermail/libc-alpha/2022-January/135520.html

> 
> A bit disappointing as I've been tinkering with updating the SLINKY linker,
> etc., to work on newer kernels, and it fundamentally depends on preloading.
> I suppose patching back in preloading in addition to this patch won't be
> anymore annoying than it already was :) .