elf: Don't call fatal_error in _dl_signal_error

Don't call fatal_error in _dl_signal_error since _dl_signal_error should
only be called from _dl_catch_exception and get_catch should never return
NULL.  Otherwise, fatal_error should be called directly instead.
---
 elf/dl-catch.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

On 03/04/24 09:39, H.J. Lu wrote:
> Don't call fatal_error in _dl_signal_error since _dl_signal_error should
> only be called from _dl_catch_exception and get_catch should never return
> NULL.  Otherwise, fatal_error should be called directly instead.

Is this related to BZ#31596 or did you catch it by code review?  I think 
this is required for lazy binding being fatal error on initializer 
functions (elf/dl-open.c:829).

> ---
>  elf/dl-catch.c | 13 ++++---------
>  1 file changed, 4 insertions(+), 9 deletions(-)
> 
> diff --git a/elf/dl-catch.c b/elf/dl-catch.c
> index 2109516dba..a023555165 100644
> --- a/elf/dl-catch.c
> +++ b/elf/dl-catch.c
> @@ -117,16 +117,11 @@ _dl_signal_error (int errcode, const char *objname, const char *occasion,
>    if (! errstring)
>      errstring = N_("DYNAMIC LINKER BUG!!!");
>  
> -  if (lcatch != NULL)
> -    {
> -      _dl_exception_create (lcatch->exception, objname, errstring);
> -      *lcatch->errcode = errcode;
> +  _dl_exception_create (lcatch->exception, objname, errstring);
> +  *lcatch->errcode = errcode;
>  
> -      /* We do not restore the signal mask because none was saved.  */
> -      __longjmp (lcatch->env[0].__jmpbuf, 1);
> -    }
> -  else
> -    fatal_error (errcode, objname, occasion, errstring);
> +  /* We do not restore the signal mask because none was saved.  */
> +  __longjmp (lcatch->env[0].__jmpbuf, 1);
>  }
>  rtld_hidden_def (_dl_signal_error)
>

On Wed, Apr 3, 2024 at 12:54 PM Adhemerval Zanella Netto
<adhemerval.zanella@linaro.org> wrote:
>
>
>
> On 03/04/24 09:39, H.J. Lu wrote:
> > Don't call fatal_error in _dl_signal_error since _dl_signal_error should
> > only be called from _dl_catch_exception and get_catch should never return
> > NULL.  Otherwise, fatal_error should be called directly instead.
>
> Is this related to BZ#31596 or did you catch it by code review?  I think

Yes, it is related.  I noticed by code review.

> this is required for lazy binding being fatal error on initializer
> functions (elf/dl-open.c:829).

elf/dl-open.c:829 calls _dl_catch_exception.

> > ---
> >  elf/dl-catch.c | 13 ++++---------
> >  1 file changed, 4 insertions(+), 9 deletions(-)
> >
> > diff --git a/elf/dl-catch.c b/elf/dl-catch.c
> > index 2109516dba..a023555165 100644
> > --- a/elf/dl-catch.c
> > +++ b/elf/dl-catch.c
> > @@ -117,16 +117,11 @@ _dl_signal_error (int errcode, const char *objname, const char *occasion,
> >    if (! errstring)
> >      errstring = N_("DYNAMIC LINKER BUG!!!");
> >
> > -  if (lcatch != NULL)
> > -    {
> > -      _dl_exception_create (lcatch->exception, objname, errstring);
> > -      *lcatch->errcode = errcode;
> > +  _dl_exception_create (lcatch->exception, objname, errstring);
> > +  *lcatch->errcode = errcode;
> >
> > -      /* We do not restore the signal mask because none was saved.  */
> > -      __longjmp (lcatch->env[0].__jmpbuf, 1);
> > -    }
> > -  else
> > -    fatal_error (errcode, objname, occasion, errstring);
> > +  /* We do not restore the signal mask because none was saved.  */
> > +  __longjmp (lcatch->env[0].__jmpbuf, 1);
> >  }
> >  rtld_hidden_def (_dl_signal_error)
> >

On 03/04/24 17:00, H.J. Lu wrote:
> On Wed, Apr 3, 2024 at 12:54 PM Adhemerval Zanella Netto
> <adhemerval.zanella@linaro.org> wrote:
>>
>>
>>
>> On 03/04/24 09:39, H.J. Lu wrote:
>>> Don't call fatal_error in _dl_signal_error since _dl_signal_error should
>>> only be called from _dl_catch_exception and get_catch should never return
>>> NULL.  Otherwise, fatal_error should be called directly instead.
>>
>> Is this related to BZ#31596 or did you catch it by code review?  I think
> 
> Yes, it is related.  I noticed by code review.
> 
>> this is required for lazy binding being fatal error on initializer
>> functions (elf/dl-open.c:829).
> 
> elf/dl-open.c:829 calls _dl_catch_exception.

I think it because lazy binding errors from _dl_lookup_symbol_x calls
_dl_exception_create_format/_dl_signal_cexception instead of _dl_signal_error
mainly because it can not translate the message at the time. 

From _dl_catch_exception comment, it aims to support first argument being
NULL so all exceptions are fatal.  This change change this assumption,
meaning _dl_signal_error can not be called in this way (since now it always
expects to return the exception to caller).

> 
>>> ---
>>>  elf/dl-catch.c | 13 ++++---------
>>>  1 file changed, 4 insertions(+), 9 deletions(-)
>>>
>>> diff --git a/elf/dl-catch.c b/elf/dl-catch.c
>>> index 2109516dba..a023555165 100644
>>> --- a/elf/dl-catch.c
>>> +++ b/elf/dl-catch.c
>>> @@ -117,16 +117,11 @@ _dl_signal_error (int errcode, const char *objname, const char *occasion,
>>>    if (! errstring)
>>>      errstring = N_("DYNAMIC LINKER BUG!!!");
>>>
>>> -  if (lcatch != NULL)
>>> -    {
>>> -      _dl_exception_create (lcatch->exception, objname, errstring);
>>> -      *lcatch->errcode = errcode;
>>> +  _dl_exception_create (lcatch->exception, objname, errstring);
>>> +  *lcatch->errcode = errcode;
>>>
>>> -      /* We do not restore the signal mask because none was saved.  */
>>> -      __longjmp (lcatch->env[0].__jmpbuf, 1);
>>> -    }
>>> -  else
>>> -    fatal_error (errcode, objname, occasion, errstring);
>>> +  /* We do not restore the signal mask because none was saved.  */
>>> +  __longjmp (lcatch->env[0].__jmpbuf, 1);
>>>  }
>>>  rtld_hidden_def (_dl_signal_error)
>>>
> 
> 
>

* H. J. Lu:

> Don't call fatal_error in _dl_signal_error since _dl_signal_error should
> only be called from _dl_catch_exception and get_catch should never return
> NULL.  Otherwise, fatal_error should be called directly instead.
> ---
>  elf/dl-catch.c | 13 ++++---------
>  1 file changed, 4 insertions(+), 9 deletions(-)
>
> diff --git a/elf/dl-catch.c b/elf/dl-catch.c
> index 2109516dba..a023555165 100644
> --- a/elf/dl-catch.c
> +++ b/elf/dl-catch.c
> @@ -117,16 +117,11 @@ _dl_signal_error (int errcode, const char *objname, const char *occasion,
>    if (! errstring)
>      errstring = N_("DYNAMIC LINKER BUG!!!");
>  
> -  if (lcatch != NULL)
> -    {
> -      _dl_exception_create (lcatch->exception, objname, errstring);
> -      *lcatch->errcode = errcode;
> +  _dl_exception_create (lcatch->exception, objname, errstring);
> +  *lcatch->errcode = errcode;
>  
> -      /* We do not restore the signal mask because none was saved.  */
> -      __longjmp (lcatch->env[0].__jmpbuf, 1);
> -    }
> -  else
> -    fatal_error (errcode, objname, occasion, errstring);
> +  /* We do not restore the signal mask because none was saved.  */
> +  __longjmp (lcatch->env[0].__jmpbuf, 1);
>  }
>  rtld_hidden_def (_dl_signal_error)

elf/ld.so program-does-not-exist triggers are null pointer dereference
with this patch.

I'll post a proper test case for this, looks like we have a gap here.

Thanks,
Florian