Submitted By: Matt Burgess Date: 2012-05-06 Initial Package Version: 2.15 Upstream Status: Not Submitted Origin: Attached to the upstream bug (see Description below) Description: Fixes segfaults in various programs including, but not limited to aplay. This is upstream bug 13579: http://sourceware.org/bugzilla/show_bug.cgi?id=13579 diff -Naur glibc-2.15.orig/ChangeLog glibc-2.15/ChangeLog --- glibc-2.15.orig/ChangeLog 2012-01-01 12:16:32.000000000 +0000 +++ glibc-2.15/ChangeLog 2012-05-01 21:51:52.395250598 +0000 @@ -4980,17 +4980,10 @@ __bzero_ultra1 instead of __memset_ultra1. 2011-02-23 Andreas Schwab - Ulrich Drepper [BZ #12509] - * include/link.h (struct link_map): Add l_orig_initfini. * elf/dl-load.c (_dl_map_object_from_fd): Free realname before returning unsuccessfully. - * elf/dl-close.c (_dl_close_worker): If this is the last explicit - close of a file loaded at startup, restore the original l_initfini - list. - * elf/dl-deps.c (_dl_map_object_deps): Don't free old l_initfini - list, store the pointer. * elf/Makefile ($(objpfx)noload-mem): New rule. (noload-ENV): Define. (tests): Add $(objpfx)noload-mem. @@ -5842,6 +5835,13 @@ 2010-09-27 Andreas Schwab + * include/link.h (struct link_map): Add l_free_initfini. + * elf/dl-deps.c (_dl_map_object_deps): Set it when assigning + l_initfini. + * elf/rtld.c (dl_main): Clear it on all objects loaded on startup. + * elf/dl-libc.c (free_mem): Free l_initfini if l_free_initfini is + set. + [BZ #11611] * sysdeps/unix/sysv/linux/internal_statvfs.c (INTERNAL_STATVFS): Mask out sign-bit copies when constructing f_fsid. diff -Naur glibc-2.15.orig/elf/dl-close.c glibc-2.15/elf/dl-close.c --- glibc-2.15.orig/elf/dl-close.c 2012-01-01 12:16:32.000000000 +0000 +++ glibc-2.15/elf/dl-close.c 2012-05-01 21:48:34.130781862 +0000 @@ -1,5 +1,5 @@ /* Close a shared object opened by `_dl_open'. - Copyright (C) 1996-2007, 2009, 2010, 2011 Free Software Foundation, Inc. + Copyright (C) 1996-2007, 2009, 2010 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or @@ -119,17 +119,8 @@ if (map->l_direct_opencount > 0 || map->l_type != lt_loaded || dl_close_state != not_pending) { - if (map->l_direct_opencount == 0) - { - if (map->l_type == lt_loaded) - dl_close_state = rerun; - else if (map->l_type == lt_library) - { - struct link_map **oldp = map->l_initfini; - map->l_initfini = map->l_orig_initfini; - _dl_scope_free (oldp); - } - } + if (map->l_direct_opencount == 0 && map->l_type == lt_loaded) + dl_close_state = rerun; /* There are still references to this object. Do nothing more. */ if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_FILES, 0)) diff -Naur glibc-2.15.orig/elf/dl-deps.c glibc-2.15/elf/dl-deps.c --- glibc-2.15.orig/elf/dl-deps.c 2012-01-01 12:16:32.000000000 +0000 +++ glibc-2.15/elf/dl-deps.c 2012-05-01 21:53:12.098407007 +0000 @@ -489,6 +489,7 @@ nneeded * sizeof needed[0]); atomic_write_barrier (); l->l_initfini = l_initfini; + l->l_free_initfini = 1; } /* If we have no auxiliary objects just go on to the next map. */ @@ -689,6 +690,7 @@ l_initfini[nlist] = NULL; atomic_write_barrier (); map->l_initfini = l_initfini; + map->l_free_initfini = 1; if (l_reldeps != NULL) { atomic_write_barrier (); @@ -697,7 +699,7 @@ _dl_scope_free (old_l_reldeps); } if (old_l_initfini != NULL) - map->l_orig_initfini = old_l_initfini; + _dl_scope_free (old_l_initfini); if (errno_reason) _dl_signal_error (errno_reason == -1 ? 0 : errno_reason, objname, diff -Naur glibc-2.15.orig/elf/dl-libc.c glibc-2.15/elf/dl-libc.c --- glibc-2.15.orig/elf/dl-libc.c 2012-01-01 12:16:32.000000000 +0000 +++ glibc-2.15/elf/dl-libc.c 2012-05-01 21:48:34.131781864 +0000 @@ -270,13 +270,13 @@ for (Lmid_t ns = 0; ns < GL(dl_nns); ++ns) { - /* Remove all additional names added to the objects. */ for (l = GL(dl_ns)[ns]._ns_loaded; l != NULL; l = l->l_next) { struct libname_list *lnp = l->l_libname->next; l->l_libname->next = NULL; + /* Remove all additional names added to the objects. */ while (lnp != NULL) { struct libname_list *old = lnp; @@ -284,6 +284,10 @@ if (! old->dont_free) free (old); } + + /* Free the initfini dependency list. */ + if (l->l_free_initfini) + free (l->l_initfini); } if (__builtin_expect (GL(dl_ns)[ns]._ns_global_scope_alloc, 0) != 0 diff -Naur glibc-2.15.orig/elf/rtld.c glibc-2.15/elf/rtld.c --- glibc-2.15.orig/elf/rtld.c 2012-01-01 12:16:32.000000000 +0000 +++ glibc-2.15/elf/rtld.c 2012-05-01 21:48:34.135781872 +0000 @@ -2276,6 +2276,7 @@ lnp->dont_free = 1; lnp = lnp->next; } + l->l_free_initfini = 0; if (l != &GL(dl_rtld_map)) _dl_relocate_object (l, l->l_scope, GLRO(dl_lazy) ? RTLD_LAZY : 0, diff -Naur glibc-2.15.orig/include/link.h glibc-2.15/include/link.h --- glibc-2.15.orig/include/link.h 2012-01-01 12:16:32.000000000 +0000 +++ glibc-2.15/include/link.h 2012-05-01 21:48:34.136781874 +0000 @@ -1,6 +1,6 @@ /* Data structure for communication from the run-time dynamic linker for loaded ELF shared objects. - Copyright (C) 1995-2006, 2007, 2009, 2010, 2011 Free Software Foundation, Inc. + Copyright (C) 1995-2006, 2007, 2009, 2010 Free Software Foundation, Inc. This file is part of the GNU C Library. The GNU C Library is free software; you can redistribute it and/or @@ -192,6 +192,9 @@ during LD_TRACE_PRELINKING=1 contains any DT_SYMBOLIC libraries. */ + unsigned int l_free_initfini:1; /* Nonzero if l_initfini can be + freed, ie. not allocated with + the dummy malloc in ld.so. */ /* Collected information about own RPATH directories. */ struct r_search_path_struct l_rpath_dirs; @@ -240,9 +243,6 @@ /* List of object in order of the init and fini calls. */ struct link_map **l_initfini; - /* The init and fini list generated at startup, saved when the - object is also loaded dynamically. */ - struct link_map **l_orig_initfini; /* List of the dependencies introduced through symbol binding. */ struct link_map_reldeps