[Bug dynamic-link/24525] New: asan report memleak in add_dependency called by _dl_lookup_symbol_x

[wangbing6 at huawei dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=24525

            Bug ID: 24525
           Summary: asan report memleak in add_dependency called by
                    _dl_lookup_symbol_x
           Product: glibc
           Version: 2.27
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: wangbing6 at huawei dot com
  Target Milestone: ---

asan report memleak in add_dependency called by __dl_lookup_symbol_x:
==== callStack : Direct leak of 88 byte(s) in 1 object(s) allocated (1 objects)
from:
#0 0x7f77ba52ef in __interceptor_malloc
/usr1/code/gcc_asan_build/gcc-5.3.0/libsanitizer/asan/asan_malloc_linux.cc:62
#1 0x5574e380a7 in malloc (+0x1f0a7)
#2 0x7f7905129b in _dl_lookup_symbol_x (/lib64/ld-linux-aarch64.so.1+0xa29b)
#3 0x7f779b3cdb in do_sym (/lib64/libc.so.6+0x112cdb)
#4 0x7f77acd1ab in dlsym_doit (/lib64/libdl.so.2+0x11ab)
#5 0x7f779b4273 in _dl_catch_exception (/lib64/libc.so.6+0x113273)
#6 0x7f779b431f in __GI__dl_catch_error (/lib64/libc.so.6+0x11331f)
#7 0x7f77acd80f in _dlerror_run (/lib64/libdl.so.2+0x180f)
#8 0x7f77acd233 in dlsym (/lib64/libdl.so.2+0x1233)

and check the glibc source: _dl_lookup_symbol_x called add_dependency:

elf/dl-lookup.c Line:900
  /* We have to check whether this would bind UNDEF_MAP to an object
     in the global scope which was dynamically loaded.  In this case
     we have to prevent the latter from being unloaded unless the
     UNDEF_MAP object is also unloaded.  */
  if (__glibc_unlikely (current_value.m->l_type == lt_loaded)
      /* Don't do this for explicit lookups as opposed to implicit
         runtime lookups.  */
      && (flags & DL_LOOKUP_ADD_DEPENDENCY) != 0
      /* Add UNDEF_MAP to the dependencies.  */
      && add_dependency (undef_map, current_value.m, flags) < 0)
      /* Something went wrong.  Perhaps the object we tried to reference
         was just removed.  Try finding another definition.  */
      return _dl_lookup_symbol_x (undef_name, undef_map, ref,
                                  (flags & DL_LOOKUP_GSCOPE_LOCK)
                                  ? undef_map->l_scope : symbol_scope,
                                  version, type_class, flags, skip_map);

  /* The object is used.  */
  if (__glibc_unlikely (current_value.m->l_used == 0))
    current_value.m->l_used = 1;

  if (__glibc_unlikely (GLRO(dl_debug_mask)
                        & (DL_DEBUG_BINDINGS|DL_DEBUG_PRELINK)))
    _dl_debug_bindings (undef_name, undef_map, ref,
                        &current_value, version, type_class, protected);


and add_dependency called malloc in  elf/dl-lookup.c Line：711， without freeing
newp：


      /* Add the reference now.  */
      if (__glibc_unlikely (l_reldepsact >= undef_map->l_reldepsmax))
        {
          /* Allocate more memory for the dependency list.  Since this
             can never happen during the startup phase we can use
             `realloc'.  */
          struct link_map_reldeps *newp;
          unsigned int max
            = undef_map->l_reldepsmax ? undef_map->l_reldepsmax * 2 : 10;

#ifdef RTLD_PREPARE_FOREIGN_CALL
          RTLD_PREPARE_FOREIGN_CALL;
#endif

          newp = malloc (sizeof (*newp) + max * sizeof (struct link_map *));
          if (newp == NULL)
            {
              /* If we didn't manage to allocate memory for the list this is
                 no fatal problem.  We simply make sure the referenced object
                 cannot be unloaded.  This is semantically the correct
                 behavior.  */
              map->l_flags_1 |= DF_1_NODELETE;
              goto out;
            }
          else
            {
              if (l_reldepsact)
                memcpy (&newp->list[0], &undef_map->l_reldeps->list[0],
                        l_reldepsact * sizeof (struct link_map *));
              newp->list[l_reldepsact] = map;
              newp->act = l_reldepsact + 1;
              atomic_write_barrier ();
              void *old = undef_map->l_reldeps;
              undef_map->l_reldeps = newp;
              undef_map->l_reldepsmax = max;
              if (old)
                _dl_scope_free (old);
            }
        }
      else
        {
          undef_map->l_reldeps->list[l_reldepsact] = map;
          atomic_write_barrier ();
          undef_map->l_reldeps->act = l_reldepsact + 1;
        }

-- 
You are receiving this mail because:
You are on the CC list for the bug.