Re: segfault in ld-elf.so.1

On Mon, Feb 12, 2024 at 11:54:02AM +0200, Konstantin Belousov wrote:
> On Mon, Feb 12, 2024 at 10:35:56AM +0100, Alexander Leidinger wrote:
> > Hi,
> > 
> > dovecot (and no other program I use on this machine... at least not that I
> > notice it) segfaults in ld-elf.so.1 after an update from 2024-01-18-092730
> > to 2024-02-10-144617 (and now 2024-02-11-212006 in the hope the issue would
> > have been fixed by changes to libc/libsys since 2024-02-10-144617). The
> > issue shows up when I try to do an IMAP login. A successful authentication
> > starts the imap process which immediately segfaults.
> > 
> > I didn't recompile dovecot for the initial update, but I did now to rule
> > out a regression in this area (and to get access via imap do my normal mail
> > account).
> > 
> > 
> > Backtrace:
> The backtrace looks incomplete.  It might be the case of infinite recursion,
> but I cannot claim it from the trace.
> 
> Does the program segfault if you run it manually?  If yes, please provide
> me with the tarball of the binary and all required shared libs, including
> base system libraries, from your machine.

Regardless of my request, you might try the following.  Note that I did
not tested the patch, ensure that you have a way to recover ld-elf.so.1
if something goes wrong.

diff --git a/libexec/rtld-elf/rtld.c b/libexec/rtld-elf/rtld.c
index 24abc4580f53..2ff6455c87fc 100644
--- a/libexec/rtld-elf/rtld.c
+++ b/libexec/rtld-elf/rtld.c
@@ -2583,7 +2583,7 @@ static void
 load_filtees(Obj_Entry *obj, int flags, RtldLockState *lockstate)
 {
 
-    if (!obj->filtees_loaded) {
+    if (!obj->filtees_loaded && (flags & RTLD_LO_NOFILTEES) == 0) {
 	lock_restart_for_upgrade(lockstate);
 	load_filtee1(obj, obj->needed_filtees, flags, lockstate);
 	load_filtee1(obj, obj->needed_aux_filtees, flags, lockstate);
@@ -4479,6 +4479,7 @@ get_program_var_addr(const char *name, RtldLockState *lockstate)
 
     symlook_init(&req, name);
     req.lockstate = lockstate;
+    req.flags |= SYMLOOK_VAR;
     donelist_init(&donelist);
     if (symlook_global(&req, &donelist) != 0)
 	return (NULL);
@@ -4690,6 +4691,22 @@ symlook_needed(SymLook *req, const Needed_Entry *needed, DoneList *dlp)
     return (ESRCH);
 }
 
+static int
+symlook_obj_load_filtees(SymLook *req, SymLook *req1, const Obj_Entry *obj,
+    Needed_Entry *needed)
+{
+	DoneList donelist;
+	int flags, res;
+
+	flags = (req->flags & SYMLOOK_EARLY) != 0 ? RTLD_LO_EARLY : 0;
+	flags |= (req->flags & SYMLOOK_VAR) != 0 ? RTLD_LO_NOFILTEES : 0;
+	load_filtees(__DECONST(Obj_Entry *, obj), flags, req->lockstate);
+	donelist_init(&donelist);
+	symlook_init_from_req(req1, req);
+	res = symlook_needed(req1, needed, &donelist);
+	return (res);
+}
+
 /*
  * Search the symbol table of a single shared object for a symbol of
  * the given name and version, if requested.  Returns a pointer to the
@@ -4702,9 +4719,8 @@ symlook_needed(SymLook *req, const Needed_Entry *needed, DoneList *dlp)
 int
 symlook_obj(SymLook *req, const Obj_Entry *obj)
 {
-    DoneList donelist;
     SymLook req1;
-    int flags, res, mres;
+    int res, mres;
 
     /*
      * If there is at least one valid hash at this point, we prefer to
@@ -4719,11 +4735,8 @@ symlook_obj(SymLook *req, const Obj_Entry *obj)
 
     if (mres == 0) {
 	if (obj->needed_filtees != NULL) {
-	    flags = (req->flags & SYMLOOK_EARLY) ? RTLD_LO_EARLY : 0;
-	    load_filtees(__DECONST(Obj_Entry *, obj), flags, req->lockstate);
-	    donelist_init(&donelist);
-	    symlook_init_from_req(&req1, req);
-	    res = symlook_needed(&req1, obj->needed_filtees, &donelist);
+	    res = symlook_obj_load_filtees(req, &req1, obj,
+		obj->needed_filtees);
 	    if (res == 0) {
 		req->sym_out = req1.sym_out;
 		req->defobj_out = req1.defobj_out;
@@ -4731,11 +4744,8 @@ symlook_obj(SymLook *req, const Obj_Entry *obj)
 	    return (res);
 	}
 	if (obj->needed_aux_filtees != NULL) {
-	    flags = (req->flags & SYMLOOK_EARLY) ? RTLD_LO_EARLY : 0;
-	    load_filtees(__DECONST(Obj_Entry *, obj), flags, req->lockstate);
-	    donelist_init(&donelist);
-	    symlook_init_from_req(&req1, req);
-	    res = symlook_needed(&req1, obj->needed_aux_filtees, &donelist);
+	    res = symlook_obj_load_filtees(req, &req1, obj,
+		obj->needed_aux_filtees);
 	    if (res == 0) {
 		req->sym_out = req1.sym_out;
 		req->defobj_out = req1.defobj_out;
diff --git a/libexec/rtld-elf/rtld.h b/libexec/rtld-elf/rtld.h
index e8b15095812b..77776f241290 100644
--- a/libexec/rtld-elf/rtld.h
+++ b/libexec/rtld-elf/rtld.h
@@ -298,6 +298,7 @@ TAILQ_HEAD(obj_entry_q, Struct_Obj_Entry);
 #define	SYMLOOK_EARLY	0x04	/* Symlook is done during initialization. */
 #define	SYMLOOK_IFUNC	0x08	/* Allow IFUNC processing in
 				   reloc_non_plt(). */
+#define	SYMLOOK_VAR	0x10
 
 /* Flags for load_object(). */
 #define	RTLD_LO_NOLOAD	0x01	/* dlopen() specified RTLD_NOLOAD. */
@@ -309,6 +310,8 @@ TAILQ_HEAD(obj_entry_q, Struct_Obj_Entry);
 				   initialization during the image start. */
 #define	RTLD_LO_IGNSTLS 0x40	/* Do not allocate static TLS */
 #define	RTLD_LO_DEEPBIND 0x80	/* Force symbolic for this object */
+#define	RTLD_LO_NOFILTEES 0x100	/* Skip loading filtees, sym resolution
+				   from dlopen() */
 
 /*
  * Symbol cache entry used during relocation to avoid multiple lookups