[Bug libc/2328] New: _dl_debug_state() RT_CONSISTENT called too early

["jreiser at BitWagon dot com" <sourceware-bugzilla at sourceware dot org>]

Sometimes relocations for newly-loaded modules have not been performed when
ld.so calls _dl_debug_state with RT_CONSISTENT in .r_state.  This prevents a
debugger user from calling subroutines in newly-loaded modules to diagnose
issues with DT_INIT, etc.

Here is a testcase which shows the problem using gdb.
$ cat my_lib.c
#include <stdio.h>

int
sub1(int x)
{
        printf("sub1 %d\n", x);
}
$ cat my_main.c
#include <dlfcn.h>

int
main()
{
        void *handle = dlopen("./my_lib.so", RTLD_LAZY);
        void (*sub1)(int) = (void (*)(int))dlsym(handle, "sub1");
        sub1(6);
        return 0;
}
$ cat Makefile
CFLAGS= -g -fPIC

bug: my_main.o my_lib.so
        gcc $(CFLAGS) -o my_main my_main.o -ldl
-Wl,--dynamic-linker=/usr/local/glibc/lib/ld-linux.so.2

my_lib.so: my_lib.o
        gcc $(CFLAGS) -o my_lib.so -shared my_lib.o
$ make
cc -g -fPIC   -c -o my_main.o my_main.c
cc -g -fPIC   -c -o my_lib.o my_lib.c
gcc -g -fPIC -o my_main my_main.o -ldl
-Wl,--dynamic-linker=/usr/local/glibc/lib/ld-linux.so.2

$ gdb my_main
GNU gdb Red Hat Linux (6.3.0.0-1.98rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...Using host libthread_db
library "/lib/libthread_db.so.1".

(gdb) set stop-on-solib-events 1   ## sets a breakpoint on _dl_debug_state
(gdb) run
Starting program: /home/jreiser/bug/my_main
Reading symbols from shared object read from target memory...done.
Loaded system supplied DSO at 0x6ed000
Stopped due to shared library event
(gdb) info shared   ## which modules are in memory now?
>From        To          Syms Read   Shared Object Library
0x002f77f0  0x0030c04f  Yes         /usr/local/glibc/lib/ld-linux.so.2
(gdb) c
Continuing.
Stopped due to shared library event
(gdb) info shared
>From        To          Syms Read   Shared Object Library
0x002f77f0  0x0030c04f  Yes         /usr/local/glibc/lib/ld-linux.so.2
0x00ecac00  0x00ecbaa4  Yes         /usr/local/glibc/lib/libdl.so.2
0x005b25c0  0x0069f578  Yes         /usr/local/glibc/lib/libc.so.6
(gdb) c
Continuing.
Stopped due to shared library event
(gdb) info shared
>From        To          Syms Read   Shared Object Library
0x002f77f0  0x0030c04f  Yes         /usr/local/glibc/lib/ld-linux.so.2
0x00ecac00  0x00ecbaa4  Yes         /usr/local/glibc/lib/libdl.so.2
0x005b25c0  0x0069f578  Yes         /usr/local/glibc/lib/libc.so.6
(gdb) c
Continuing.
Stopped due to shared library event
(gdb) info shared
>From        To          Syms Read   Shared Object Library
0x002f77f0  0x0030c04f  Yes         /usr/local/glibc/lib/ld-linux.so.2
0x00ecac00  0x00ecbaa4  Yes         /usr/local/glibc/lib/libdl.so.2
0x005b25c0  0x0069f578  Yes         /usr/local/glibc/lib/libc.so.6
0x002d9420  0x002d9554  Yes         ./my_lib.so

  ## Now my_lib.so is loaded, and gdb believes that everything is ready to run.
  ## However, ld-linux has not performed relocations on my_lib.so,
  ## so there will be a SIGSEGV when the user calls sub1 in my_lib.so.

(gdb) print sub1(42)

Program received signal SIGSEGV, Segmentation fault.
0x000003f2 in ?? ()
The program being debugged was signaled while in a function called from GDB.
GDB remains in the frame where the signal was received.
To change this behavior use "set unwindonsignal on"
Evaluation of the expression containing the function (sub1) will be abandoned.
(gdb) x/i $pc
0x3f2:  Cannot access memory at address 0x3f2
(gdb) x/12i sub1
0x2d94ec <sub1>:        push   %ebp
0x2d94ed <sub1+1>:      mov    %esp,%ebp
0x2d94ef <sub1+3>:      push   %ebx
0x2d94f0 <sub1+4>:      sub    $0x14,%esp
0x2d94f3 <sub1+7>:      call   0x2d94e7 <__i686.get_pc_thunk.bx>
0x2d94f8 <sub1+12>:     add    $0x1168,%ebx
0x2d94fe <sub1+18>:     mov    0x8(%ebp),%eax
0x2d9501 <sub1+21>:     mov    %eax,0x4(%esp)
0x2d9505 <sub1+25>:     lea    0xffffef10(%ebx),%eax
0x2d950b <sub1+31>:     mov    %eax,(%esp)
0x2d950e <sub1+34>:     call   0x2d93ec   ## printf@PLT
0x2d9513 <sub1+39>:     add    $0x14,%esp
(gdb) x/i 0x2d93ec   ## printf@PLT
0x2d93ec:       jmp    *0xc(%ebx)
(gdb) x/x 0x2d94f8+0x1168+0xc
0x2da66c:       0x000003f2   ## unrelocated


[An earlier version of this report was entered at
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=179072
The problem was confirmed in "upstream" CVS HEAD as of 2006-02-10;
elf/dl-open.c -r1.126 ]

-- 
           Summary: _dl_debug_state() RT_CONSISTENT called too early
           Product: glibc
           Version: 2.3.6
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: jreiser at BitWagon dot com
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=2328

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.