PR/59751 CVS commit: src/libexec/ld.elf_so

["Taylor R Campbell" <riastradh%netbsd.org@localhost>]

The following reply was made to PR lib/59751; it has been noted by GNATS.

From: "Taylor R Campbell" <riastradh%netbsd.org@localhost>
To: gnats-bugs%gnats.NetBSD.org@localhost
Cc: 
Subject: PR/59751 CVS commit: src/libexec/ld.elf_so
Date: Sun, 19 Jul 2026 19:56:06 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Jul 19 19:56:06 UTC 2026
 
 Modified Files:
 	src/libexec/ld.elf_so: rtld.c
 
 Log Message:
 ld.elf_so: Set _rtld_objself.refcount = 1.
 
 This is the object for ld.elf_so itself.  It can be opened with
 dlopen("/usr/libexec/ld.elf_so"), and paths downstream of that assert
 that the returned object has refcount > 0 to detect use-after-free
 mistakes in rtld.  Since ld.elf_so must never be unloaded, let's just
 make sure the reference count is always positive.
 
 (It's conceivable that one could dlopen an object with a DT_RPATH
 entry having "/usr/libexec" and a DT_NEEDED entry having "ld.elf_so",
 causing recursive loading of ld.elf_so -- and if one then dlcloses
 the same object, it might lead to trying to free _rtld_objself.  So
 perhaps _rtld_load_object should just increment the reference count
 of _rtld_objself itself.  But this is a simpler change that already
 fixes some existing tests -- such as any rump tests -- when used with
 an ld.elf_built with -DDEBUG.)
 
 Followup for:
 
 PR lib/59751: dlclose is not MT-safe depending on the libraries
 unloaded
 
 
 To generate a diff of this commit:
 cvs rdiff -u -r1.227 -r1.228 src/libexec/ld.elf_so/rtld.c
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.