[PATCH v3] dlfcn: Fix dlclose crash in atexit handler after thread_local destructor (BZ 33598)
Florian Weimer
fw@deneb.enyo.de
Tue May 5 19:36:02 GMT 2026
* Adhemerval Zanella:
> @@ -46,6 +47,9 @@ __run_exit_handlers (int status, struct exit_function_list **listp,
> /* The exit should never return, so there is no need to unlock it. */
> __libc_lock_lock_recursive (__exit_lock);
>
> + /* Disable unmap objects through dlclose by TLS destructor (BZ 33598). */
> + GL(dl_at_exit) = true;
> +
> /* First, call the TLS destructors. */
> if (run_dtors)
> call_function_static_weak (__call_tls_dtors);
> diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
> index 15c46598539..236419c593c 100644
> --- a/sysdeps/generic/ldsodefs.h
> +++ b/sysdeps/generic/ldsodefs.h
> @@ -441,6 +441,9 @@ struct rtld_global
> /* Generation counter for the dtv. */
> EXTERN size_t _dl_tls_generation;
>
> + /* Disable unmap objects during __run_exit_handlers. */
> + EXTERN bool _dl_at_exit;
> +
> /* Scopes to free after next THREAD_GSCOPE_WAIT (). */
> EXTERN struct dl_scope_free_list
> {
Would it be simpler to do what the comment says? Just guard the
munmap call that is part of dlclose? This could even be considered an
optimization.
More information about the Libc-alpha
mailing list