From patchwork Wed Jul 4 15:55:41 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Christophe Lyon X-Patchwork-Id: 939467 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=uclibc-ng.org (client-ip=89.238.66.15; helo=helium.openadk.org; envelope-from=devel-bounces@uclibc-ng.org; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=st.com Received: from helium.openadk.org (helium.openadk.org [89.238.66.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 41LQpM0f6Cz9s3q for ; Thu, 5 Jul 2018 02:06:19 +1000 (AEST) Received: from helium.openadk.org (localhost [IPv6:::1]) by helium.openadk.org (Postfix) with ESMTP id A62AA10002; Wed, 4 Jul 2018 18:06:15 +0200 (CEST) X-Original-To: devel@uclibc-ng.org Delivered-To: devel@helium.openadk.org Received: from mx07-00178001.pphosted.com (mx08-00178001.pphosted.com [91.207.212.93]) by helium.openadk.org (Postfix) with ESMTPS id 4AC811016E for ; Wed, 4 Jul 2018 18:06:12 +0200 (CEST) Received: from pps.filterd (m0046660.ppops.net [127.0.0.1]) by mx08-.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id w64G4Wij024394; Wed, 4 Jul 2018 18:06:11 +0200 Received: from beta.dmz-eu.st.com (beta.dmz-eu.st.com [164.129.1.35]) by mx08-00178001.pphosted.com with ESMTP id 2k0dnqvsp2-1 (version=TLSv1 cipher=ECDHE-RSA-AES256-SHA bits=256 verify=NOT); Wed, 04 Jul 2018 18:06:11 +0200 Received: from zeta.dmz-eu.st.com (zeta.dmz-eu.st.com [164.129.230.9]) by beta.dmz-eu.st.com (STMicroelectronics) with ESMTP id 04C6948; Wed, 4 Jul 2018 16:06:11 +0000 (GMT) Received: from Webmail-eu.st.com (sfhdag5node1.st.com [10.75.127.13]) by zeta.dmz-eu.st.com (STMicroelectronics) with ESMTP id E79202C48B; Wed, 4 Jul 2018 16:06:10 +0000 (GMT) Received: from gnb.st.com (10.75.127.44) by SFHDAG5NODE1.st.com (10.75.127.13) with Microsoft SMTP Server (TLS) id 15.0.1347.2; Wed, 4 Jul 2018 18:06:10 +0200 From: Christophe Lyon To: , Date: Wed, 4 Jul 2018 17:55:41 +0200 Message-ID: <20180704155605.1892-29-christophe.lyon@st.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20180704155605.1892-1-christophe.lyon@st.com> References: <20180704155605.1892-1-christophe.lyon@st.com> MIME-Version: 1.0 X-Originating-IP: [10.75.127.44] X-ClientProxiedBy: SFHDAG6NODE2.st.com (10.75.127.17) To SFHDAG5NODE1.st.com (10.75.127.13) X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2018-07-04_05:, , signatures=0 Subject: [uclibc-ng-devel] [PATCH 28/32] Fix htab_delete loop counter X-BeenThere: devel@uclibc-ng.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: uClibc-ng Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: devel-bounces@uclibc-ng.org Sender: "devel" dlclose can crash or stuck the system: When calling dlclose() then system can crash or freeze, because htab_delete() in ldso/ldso/fdpic/dl-inlines.h uses size_t for i which is a typedef to unsigned int. We exit the loop on negative value of i which can never occur since i is an unsigned int. This leads to random free of various pointers that kill the system. * ldso/include/inline-hashtab.h (htab_delete): Change type of 'i' to int. Signed-off-by: Mickaël Guêné Signed-off-by: Christophe Lyon diff --git a/ldso/include/inline-hashtab.h b/ldso/include/inline-hashtab.h index 4a48120..c6c584b 100644 --- a/ldso/include/inline-hashtab.h +++ b/ldso/include/inline-hashtab.h @@ -107,7 +107,7 @@ htab_create(void) static __always_inline void htab_delete(struct funcdesc_ht *htab) { - size_t i; + int i; for (i = htab->size - 1; i >= 0; i--) if (htab->entries[i])