[PATCH v2] elf: Don't crash in dlsym when tail-called from a constructor [BZ #34156]

[Florian Weimer]

* Daan De Meyer:

> If a shared library's constructor calls dlsym and discards the result,
> the compiler is free to lower the call to a tail jump.  The dynamic
> linker then resolves the apparent caller to ld.so's own link map, which
> has no l_scope, and crashes in _dl_lookup_symbol_x dereferencing the
> NULL scope pointer.
>
> Tail-call optimization is a legal C transformation and there is no way
> for the dynamic linker to recover the real caller from the elided frame.
> Detect the situation by its observable effect -- a link map with no
> l_scope -- and fall back to the main program's link map, the same
> treatment used when the caller's address is otherwise unrecognized.
>
> The check is written against l->l_scope rather than against _dl_rtld_map
> directly because dl-sym-post.h is also compiled into libc.so, where
> _dl_rtld_map is not visible (it lives only in ld.so).
>
> Add dlfcn/tst-dlsym-ctor exercising the pattern.  Without the fix the
> test SIGSEGVs during dlopen; with the fix dlopen returns cleanly.
>
> Signed-off-by: Daan De Meyer <daan@amutable.com>

Sorry, I forgot to mention this:

New files contributed under DCO should use the DCO copyright
statement, “Copyright The GNU Toolchain Authors.”