[Bug c/66826] New: Unused dlsym return results in segfault
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66826 Bug ID: 66826 Summary: Unused dlsym return results in segfault Product: gcc Version: unknown Status: UNCONFIRMED Severity: normal Priority: P3 Component: c Assignee: unassigned at gcc dot gnu.org Reporter: quae at daurnimator dot com Target Milestone: --- Having a weird issue here: if I dlsym() something in a constructor, but don't use the result; the shared library segfaults at load. bug-main.c: #define _GNU_SOURCE #include int main() { void *foo = dlopen("./shared.so", RTLD_NOW); void (*some_exported_function)() = dlsym(foo, "some_exported_function"); some_exported_function(); return 0; } bug-shared.c: #define _GNU_SOURCE #include #include static int (*pointer) (); static int stub () { return 0; } __attribute__((constructor)) static void some_init() { if ((pointer = dlsym(RTLD_DEFAULT, "anything")) == NULL) { pointer = stub; } } void some_exported_function() { printf("in some_exported_function\n"); printf("%p\n", pointer); } Compile with: gcc -shared -O2 -fPIC bug-shared.c -ldl -o shared.so gcc -O2 -fPIC bug-main.c -ldl Now comment out the `printf` of the pointer in bug-shared.c; and it'll get a segfault. Backtrace: #0 0x77de4b77 in _dl_lookup_symbol_x () from /lib64/ld-linux-x86-64.so.2 #1 0x77951b91 in do_sym () from /usr/lib/libc.so.6 #2 0x77bd80f4 in ?? () from /usr/lib/libdl.so.2 #3 0x77de9f94 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 #4 0x77bd85e1 in ?? () from /usr/lib/libdl.so.2 #5 0x77bd8148 in dlsym () from /usr/lib/libdl.so.2 #6 0x77dea0ea in call_init.part () from /lib64/ld-linux-x86-64.so.2 #7 0x77dea1fb in _dl_init () from /lib64/ld-linux-x86-64.so.2 #8 0x77dee627 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2 #9 0x77de9f94 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 #10 0x77dede01 in _dl_open () from /lib64/ld-linux-x86-64.so.2 #11 0x77bd7fc9 in ?? () from /usr/lib/libdl.so.2 #12 0x77de9f94 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 #13 0x77bd85e1 in ?? () from /usr/lib/libdl.so.2 #14 0x77bd8061 in dlopen () from /usr/lib/libdl.so.2 #15 0x00400622 in main () $ gcc -dumpversion 5.1.0 Works fine with -O0 Works fine with clang
[Bug c/66826] Unused result from dlsym in constructor results in a segfault
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66826 --- Comment #1 from Daurnimator --- nalaginrut (from #gcc irc channel) confirmed that the issue only occurs in GCC 5 at -O2 and higher. (the bug is *not* present in GCC 4.9 or at -O1). Note: only the compilation of shared.so matters (the main binary can be compiled with any setting or compiler and the same behaviour is shown.)
[Bug c/66826] Unused result from dlsym in constructor results in a segfault
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66826 --- Comment #2 from Daurnimator --- I recompiled glibc with debug symbols. Program received signal SIGSEGV, Segmentation fault. _dl_lookup_symbol_x (undef_name=0x77634775 "anything", undef_map=0x77ffd998 <_rtld_local+2456>, ref=0x7fffdca8, symbol_scope=0x0, version=0x0, type_class=0, flags=3, skip_map=0x0) at dl-lookup.c:769 769 while ((*scope)->r_list[i] != skip_map) (gdb) bt #0 _dl_lookup_symbol_x (undef_name=0x77634775 "anything", undef_map=0x77ffd998 <_rtld_local+2456>, ref=0x7fffdca8, symbol_scope=0x0, version=0x0, type_class=0, flags=3, skip_map=0x0) at dl-lookup.c:769 #1 0x77951b91 in do_sym (handle=0x0, name=0x77634775 "anything", who=, vers=0x0, flags=2) at dl-sym.c:161 #2 0x77bd80f4 in ?? () from /usr/lib/libdl.so.2 #3 0x77de9f94 in _dl_catch_error (objname=0x77dda0f0, errstring=0x77dda0f8, mallocedp=0x77dda0e8, operate=0x77bd80e0, args=0x7fffdea0) at dl-error.c:187 #4 0x77bd85e1 in ?? () from /usr/lib/libdl.so.2 #5 0x77bd8148 in dlsym () from /usr/lib/libdl.so.2 #6 0x77dea0ea in call_init (l=, argc=argc@entry=1, argv=argv@entry=0x7fffe498, env=env@entry=0x7fffe4a8) at dl-init.c:72 #7 0x77dea1fb in call_init (env=0x7fffe4a8, argv=0x7fffe498, argc=1, l=) at dl-init.c:30 #8 _dl_init (main_map=main_map@entry=0x601030, argc=1, argv=0x7fffe498, env=0x7fffe4a8) at dl-init.c:120 #9 0x77dee627 in dl_open_worker (a=a@entry=0x7fffe168) at dl-open.c:568 #10 0x77de9f94 in _dl_catch_error (objname=objname@entry=0x7fffe158, errstring=errstring@entry=0x7fffe160, mallocedp=mallocedp@entry=0x7fffe157, operate=operate@entry=0x77dee260 , args=args@entry=0x7fffe168) at dl-error.c:187 #11 0x77dede01 in _dl_open (file=0x4006e4 "./shared.so", mode=-2147483646, caller_dlopen=0x400535 , nsid=-2, argc=1, argv=, env=0x7fffe4a8) at dl-open.c:652 #12 0x77bd7fc9 in ?? () from /usr/lib/libdl.so.2 #13 0x77de9f94 in _dl_catch_error (objname=0x77dda0f0, errstring=0x77dda0f8, mallocedp=0x77dda0e8, operate=0x77bd7f70, args=0x7fffe380) at dl-error.c:187 #14 0x77bd85e1 in ?? () from /usr/lib/libdl.so.2 #15 0x77bd8061 in dlopen () from /usr/lib/libdl.so.2 #16 0x00400535 in main () (gdb) info locals old_hash = 4294967295 current_value = {s = 0x0, m = 0x0} scope = 0x0 __PRETTY_FUNCTION__ = "_dl_lookup_symbol_x" i = 0 protected = (gdb) info args undef_name = 0x77634775 "anything" undef_map = 0x77ffd998 <_rtld_local+2456> ref = 0x7fffdca8 symbol_scope = 0x0 version = 0x0 type_class = 0 flags = 3 skip_map = 0x0