[Bug 893605]

[Gauryogesh-nsit]

I know this issue is closed, but for someone who needs to see the exact test case using which how this bug is reproduced by simple C test code, please find below simple C test case:
***************************** Source Code ***********************************
yogesh$ cat lib1.c
#include <stdio.h>

int lib1_func()
{
        return lib2_func();
}
----------------------------------------------
yogesh$ cat lib2.c
#include <stdio.h>

int lib2_func()
{
        return 10;
}
----------------------------------------------
yogesh$ cat main.c
#include <stdio.h>
#include <dlfcn.h>
#include <pthread.h>

void *handle;

static void *thread_abc()
{
        handle = dlopen ("./lib1.so", RTLD_LAZY | RTLD_GLOBAL);
        void *func = dlsym (handle, "lib2_func");
        printf ("<thread_abc> Handle:%p, func:%p \n", handle, func);
        dlclose (handle);
        return NULL;
}

static void *thread_xyz()
{
        handle = dlopen ("./lib1.so", RTLD_LAZY | RTLD_GLOBAL);
        void *func = dlsym (handle, "lib2_func");
        printf ("<thread_xyz> Handle:%p, func:%p \n", handle, func);
        dlclose (handle);
        return NULL;
}

int main()
{
        pthread_t abc_arr[1000], xyz_arr[1000];
        int i=0;
        handle = dlopen ("./lib1.so", RTLD_LAZY | RTLD_GLOBAL);
        void *func = dlsym (handle, "lib2_func");
        printf ("<main> Handle:%p, func:%p \n", handle, func);
        for (i=0;i<10;i++)
        {
                pthread_create(&abc_arr[i], NULL, thread_abc, NULL);
                pthread_create(&xyz_arr[i], NULL, thread_xyz, NULL);
        }

        printf ("<main> Handle:%p, func:%p \n", handle, func);
        dlclose (handle);

        for (i=0;i<1000;i++)
        {
                pthread_create(&abc_arr[i], NULL, thread_abc, NULL);
                pthread_create(&xyz_arr[i], NULL, thread_xyz, NULL);
        }
        for (i=0;i<10;i++)
        {
                pthread_join(abc_arr[i], NULL);
                pthread_join(xyz_arr[i], NULL);
        }
        printf ("Returning from main\n");
        return 0;
}
************************** Compilation steps *********************
gcc -g -fPIC -shared -o lib2.so lib2.c &&				
gcc -g -fPIC -shared -o lib1.so lib1.c ./lib2.so &&	
gcc -g main.c ./lib1.so ./lib2.so -ldl -lpthread	
*******************************************************************

With the above test case this issue is 100% reproducible.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to eglibc in Ubuntu.
https://bugs.launchpad.net/bugs/893605

Title:
  crashes with glibc-2.14/2.15 on dlopen (seen with kvm and gnucash)

Status in The GNU C Library:
  Fix Released
Status in “eglibc” package in Ubuntu:
  Fix Released
Status in “glibc” package in Fedora:
  Unknown

Bug description:
  seen with glibc-2.14/glibc-2.15:

  kvm -cdrom <iso>

  Program received signal SIGSEGV, Segmentation fault.
  0xb7fe7740 in ?? () from /lib/ld-linux.so.2
  (gdb) bt
  #0  0xb7fe7740 in ?? () from /lib/ld-linux.so.2
  #1  0xb7fe7eb9 in ?? () from /lib/ld-linux.so.2
  #2  0xb7a26490 in do_sym (handle=0xb7d86860, 
      name=0xb7c7ff4f "XAllocClassHint", who=<optimized out>, vers=0x0, flags=2)
      at dl-sym.c:178
  #3  0xb7a26927 in _dl_sym (handle=<optimized out>, name=<optimized out>, 
      who=<optimized out>) at dl-sym.c:283
  #4  0xb778cd67 in dlsym_doit (a=0xbfffeef0) at dlsym.c:51
  #5  0xb7feccaf in ?? () from /lib/ld-linux.so.2
  #6  0xb778d33a in _dlerror_run (operate=0xb778cd40 <dlsym_doit>, 
      args=0xbfffeef0) at dlerror.c:164
  #7  0xb778cde4 in __dlsym (handle=0xb7d86860, 
      name=0xb7c7ff4f "XAllocClassHint") at dlsym.c:71
  #8  0xb7c56b5a in SDL_LoadFunction () from /usr/lib/libSDL-1.2.so.0
  #9  0xb7c58511 in ?? () from /usr/lib/libSDL-1.2.so.0
  #10 0xb7c5a8aa in ?? () from /usr/lib/libSDL-1.2.so.0
  #11 0xb7c61825 in ?? () from /usr/lib/libSDL-1.2.so.0
  #12 0xb7c5155a in SDL_VideoInit () from /usr/lib/libSDL-1.2.so.0
  #13 0xb7c25c7a in SDL_InitSubSystem () from /usr/lib/libSDL-1.2.so.0
  #14 0xb7c25cfb in SDL_Init () from /usr/lib/libSDL-1.2.so.0
  #15 0x00202967 in ?? ()
  ---Type <return> to continue, or q <return> to quit---
  #16 0x0013cfdc in main ()

  gnucash:

  
  Program received signal SIGSEGV, Segmentation fault.
  0x00119740 in ?? () from /lib/ld-linux.so.2
  (gdb) bt
  #0  0x00119740 in ?? () from /lib/ld-linux.so.2
  #1  0x00119eb9 in ?? () from /lib/ld-linux.so.2
  #2  0x00c0a490 in do_sym (handle=0xb7ffd000, 
      name=0x10eeec4 "g_module_check_init", who=<optimized out>, vers=0x0, 
      flags=2) at dl-sym.c:178
  #3  0x00c0a927 in _dl_sym (handle=<optimized out>, name=<optimized out>, 
      who=<optimized out>) at dl-sym.c:283
  #4  0x03195d67 in dlsym_doit (a=0xbfffedc0) at dlsym.c:51
  #5  0x0011ecaf in ?? () from /lib/ld-linux.so.2
  #6  0x0319633a in _dlerror_run (operate=0x3195d40 <dlsym_doit>, 
      args=0xbfffedc0) at dlerror.c:164
  #7  0x03195de4 in __dlsym (handle=0xb7ffd000, 
      name=0x10eeec4 "g_module_check_init") at dlsym.c:71
  #8  0x010ee065 in g_module_symbol ()
     from /usr/lib/i386-linux-gnu/libgmodule-2.0.so.0
  #9  0x010ee54f in g_module_open ()
     from /usr/lib/i386-linux-gnu/libgmodule-2.0.so.0
  #10 0x003ff61e in ?? () from /usr/lib/gnucash/libgnc-module.so.0
  #11 0x003ff90b in gnc_module_load () from /usr/lib/gnucash/libgnc-module.so.0
  #12 0x0804ca5f in _start ()

To manage notifications about this bug go to:
https://bugs.launchpad.net/glibc/+bug/893605/+subscriptions