If libthr.so is dlopened without RTLD_GLOBAL flag, the libthr symbols

do not participate in the global symbols namespace, but rtld locks are
still replaced and functions are interposed.  In particular,
__pthread_map_stacks_exec is resolved to the libc version.  If a
library is loaded later, which requires adjustment of the stack
protection mode, rtld calls into libc __pthread_map_stacks_exec due to
the symbols scope.  The libc version might recurse into binder and
recursively acquire rtld bind lock, causing the hang.

Make libc __pthread_map_stacks_exec() interposed, which synchronizes
rtld locks and version of the stack exec hook when libthr loaded,
regardless of the symbol scope control or symbol resolution order.

The __pthread_map_stacks_exec() symbol is removed from the private
version in libthr since libc symbol now operates correctly in presence
of libthr.

Reported and tested by:	markj
Sponsored by:	The FreeBSD Foundation
MFC after:	2 weeks

3 files changed, 12 insertions, 2 deletions

diff --git a/lib/libc/gen/elf_utils.c b/lib/libc/gen/elf_utils.c
index 069f62e..80ab013 100644
--- a/lib/libc/gen/elf_utils.c
+++ b/lib/libc/gen/elf_utils.c
@@ -32,6 +32,7 @@
 #include <sys/sysctl.h>
 #include <link.h>
 #include <stddef.h>
+#include "libc_private.h"
 
 int __elf_phdr_match_addr(struct dl_phdr_info *, void *);
 void __pthread_map_stacks_exec(void);
@@ -54,9 +55,8 @@ __elf_phdr_match_addr(struct dl_phdr_info *phdr_info, void *addr)
 	return (i != phdr_info->dlpi_phnum);
 }
 
-#pragma weak __pthread_map_stacks_exec
 void
-__pthread_map_stacks_exec(void)
+__libc_map_stacks_exec(void)
 {
 	int mib[2];
 	struct rlimit rlim;
@@ -75,3 +75,10 @@ __pthread_map_stacks_exec(void)
 	    rlim.rlim_cur, _rtld_get_stack_prot());
 }
 
+#pragma weak __pthread_map_stacks_exec
+void
+__pthread_map_stacks_exec(void)
+{
+
+	((void (*)(void))__libc_interposing[INTERPOS_map_stacks_exec])();
+}
diff --git a/lib/libc/include/libc_private.h b/lib/libc/include/libc_private.h
index 5caf9a3..554f3a2 100644
--- a/lib/libc/include/libc_private.h
+++ b/lib/libc/include/libc_private.h
@@ -224,6 +224,7 @@ enum {
 	INTERPOS_kevent,
 	INTERPOS_wait6,
 	INTERPOS_ppoll,
+	INTERPOS_map_stacks_exec,
 	INTERPOS_MAX
 };
 
@@ -381,6 +382,7 @@ int _elf_aux_info(int aux, void *buf, int buflen);
 struct dl_phdr_info;
 int __elf_phdr_match_addr(struct dl_phdr_info *, void *);
 void __init_elf_aux_vector(void);
+void __libc_map_stacks_exec();
 
 void	_pthread_cancel_enter(int);
 void	_pthread_cancel_leave(int);
diff --git a/lib/libc/sys/interposing_table.c b/lib/libc/sys/interposing_table.c
index 08dfbb1..75bb280 100644
--- a/lib/libc/sys/interposing_table.c
+++ b/lib/libc/sys/interposing_table.c
@@ -78,6 +78,7 @@ interpos_func_t __libc_interposing[INTERPOS_MAX] = {
 	SLOT(kevent, __sys_kevent),
 	SLOT(wait6, __sys_wait6),
 	SLOT(ppoll, __sys_ppoll),
+	SLOT(map_stacks_exec, __libc_map_stacks_exec),
 };
 #undef SLOT