1 /* Look up a symbol in the loaded objects.
2    Copyright (C) 1995-2022 Free Software Foundation, Inc.
3    This file is part of the GNU C Library.
4 
5    The GNU C Library is free software; you can redistribute it and/or
6    modify it under the terms of the GNU Lesser General Public
7    License as published by the Free Software Foundation; either
8    version 2.1 of the License, or (at your option) any later version.
9 
10    The GNU C Library is distributed in the hope that it will be useful,
11    but WITHOUT ANY WARRANTY; without even the implied warranty of
12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
13    Lesser General Public License for more details.
14 
15    You should have received a copy of the GNU Lesser General Public
16    License along with the GNU C Library; if not, see
17    <https://www.gnu.org/licenses/>.  */
18 
19 #include <alloca.h>
20 #include <libintl.h>
21 #include <stdlib.h>
22 #include <string.h>
23 #include <unistd.h>
24 #include <ldsodefs.h>
25 #include <dl-hash.h>
26 #include <dl-machine.h>
27 #include <dl-new-hash.h>
28 #include <dl-protected.h>
29 #include <sysdep-cancel.h>
30 #include <libc-lock.h>
31 #include <tls.h>
32 #include <atomic.h>
33 #include <elf_machine_sym_no_match.h>
34 
35 #include <assert.h>
36 
37 #define VERSTAG(tag)	(DT_NUM + DT_THISPROCNUM + DT_VERSIONTAGIDX (tag))
38 
39 struct sym_val
40   {
41     const ElfW(Sym) *s;
42     struct link_map *m;
43   };
44 
45 
46 /* Statistics function.  */
47 #ifdef SHARED
48 # define bump_num_relocations() ++GL(dl_num_relocations)
49 #else
50 # define bump_num_relocations() ((void) 0)
51 #endif
52 
53 /* Utility function for do_lookup_x. The caller is called with undef_name,
54    ref, version, flags and type_class, and those are passed as the first
55    five arguments. The caller then computes sym, symidx, strtab, and map
56    and passes them as the next four arguments. Lastly the caller passes in
57    versioned_sym and num_versions which are modified by check_match during
58    the checking process.  */
ElfW(Sym)59 static const ElfW(Sym) *
60 check_match (const char *const undef_name,
61 	     const ElfW(Sym) *const ref,
62 	     const struct r_found_version *const version,
63 	     const int flags,
64 	     const int type_class,
65 	     const ElfW(Sym) *const sym,
66 	     const Elf_Symndx symidx,
67 	     const char *const strtab,
68 	     const struct link_map *const map,
69 	     const ElfW(Sym) **const versioned_sym,
70 	     int *const num_versions)
71 {
72   unsigned int stt = ELFW(ST_TYPE) (sym->st_info);
73   assert (ELF_RTYPE_CLASS_PLT == 1);
74   if (__glibc_unlikely ((sym->st_value == 0 /* No value.  */
75 			 && sym->st_shndx != SHN_ABS
76 			 && stt != STT_TLS)
77 			|| elf_machine_sym_no_match (sym)
78 			|| (type_class & (sym->st_shndx == SHN_UNDEF))))
79     return NULL;
80 
81   /* Ignore all but STT_NOTYPE, STT_OBJECT, STT_FUNC,
82      STT_COMMON, STT_TLS, and STT_GNU_IFUNC since these are no
83      code/data definitions.  */
84 #define ALLOWED_STT \
85   ((1 << STT_NOTYPE) | (1 << STT_OBJECT) | (1 << STT_FUNC) \
86    | (1 << STT_COMMON) | (1 << STT_TLS) | (1 << STT_GNU_IFUNC))
87   if (__glibc_unlikely (((1 << stt) & ALLOWED_STT) == 0))
88     return NULL;
89 
90   if (sym != ref && strcmp (strtab + sym->st_name, undef_name))
91     /* Not the symbol we are looking for.  */
92     return NULL;
93 
94   const ElfW(Half) *verstab = map->l_versyms;
95   if (version != NULL)
96     {
97       if (__glibc_unlikely (verstab == NULL))
98 	{
99 	  /* We need a versioned symbol but haven't found any.  If
100 	     this is the object which is referenced in the verneed
101 	     entry it is a bug in the library since a symbol must
102 	     not simply disappear.
103 
104 	     It would also be a bug in the object since it means that
105 	     the list of required versions is incomplete and so the
106 	     tests in dl-version.c haven't found a problem.*/
107 	  assert (version->filename == NULL
108 		  || ! _dl_name_match_p (version->filename, map));
109 
110 	  /* Otherwise we accept the symbol.  */
111 	}
112       else
113 	{
114 	  /* We can match the version information or use the
115 	     default one if it is not hidden.  */
116 	  ElfW(Half) ndx = verstab[symidx] & 0x7fff;
117 	  if ((map->l_versions[ndx].hash != version->hash
118 	       || strcmp (map->l_versions[ndx].name, version->name))
119 	      && (version->hidden || map->l_versions[ndx].hash
120 		  || (verstab[symidx] & 0x8000)))
121 	    /* It's not the version we want.  */
122 	    return NULL;
123 	}
124     }
125   else
126     {
127       /* No specific version is selected.  There are two ways we
128 	 can got here:
129 
130 	 - a binary which does not include versioning information
131 	 is loaded
132 
133 	 - dlsym() instead of dlvsym() is used to get a symbol which
134 	 might exist in more than one form
135 
136 	 If the library does not provide symbol version information
137 	 there is no problem at all: we simply use the symbol if it
138 	 is defined.
139 
140 	 These two lookups need to be handled differently if the
141 	 library defines versions.  In the case of the old
142 	 unversioned application the oldest (default) version
143 	 should be used.  In case of a dlsym() call the latest and
144 	 public interface should be returned.  */
145       if (verstab != NULL)
146 	{
147 	  if ((verstab[symidx] & 0x7fff)
148 	      >= ((flags & DL_LOOKUP_RETURN_NEWEST) ? 2 : 3))
149 	    {
150 	      /* Don't accept hidden symbols.  */
151 	      if ((verstab[symidx] & 0x8000) == 0
152 		  && (*num_versions)++ == 0)
153 		/* No version so far.  */
154 		*versioned_sym = sym;
155 
156 	      return NULL;
157 	    }
158 	}
159     }
160 
161   /* There cannot be another entry for this symbol so stop here.  */
162   return sym;
163 }
164 
165 /* Utility function for do_lookup_unique.  Add a symbol to TABLE.  */
166 static void
enter_unique_sym(struct unique_sym * table,size_t size,unsigned int hash,const char * name,const ElfW (Sym)* sym,const struct link_map * map)167 enter_unique_sym (struct unique_sym *table, size_t size,
168                   unsigned int hash, const char *name,
169                   const ElfW(Sym) *sym, const struct link_map *map)
170 {
171   size_t idx = hash % size;
172   size_t hash2 = 1 + hash % (size - 2);
173   while (table[idx].name != NULL)
174     {
175       idx += hash2;
176       if (idx >= size)
177         idx -= size;
178     }
179 
180   table[idx].hashval = hash;
181   table[idx].name = name;
182   table[idx].sym = sym;
183   table[idx].map = map;
184 }
185 
186 /* Mark MAP as NODELETE according to the lookup mode in FLAGS.  During
187    initial relocation, NODELETE state is pending only.  */
188 static void
mark_nodelete(struct link_map * map,int flags)189 mark_nodelete (struct link_map *map, int flags)
190 {
191   if (flags & DL_LOOKUP_FOR_RELOCATE)
192     map->l_nodelete_pending = true;
193   else
194     map->l_nodelete_active = true;
195 }
196 
197 /* Return true if MAP is marked as NODELETE according to the lookup
198    mode in FLAGS> */
199 static bool
is_nodelete(struct link_map * map,int flags)200 is_nodelete (struct link_map *map, int flags)
201 {
202   /* Non-pending NODELETE always counts.  Pending NODELETE only counts
203      during initial relocation processing.  */
204   return map->l_nodelete_active
205     || ((flags & DL_LOOKUP_FOR_RELOCATE) && map->l_nodelete_pending);
206 }
207 
208 /* Utility function for do_lookup_x. Lookup an STB_GNU_UNIQUE symbol
209    in the unique symbol table, creating a new entry if necessary.
210    Return the matching symbol in RESULT.  */
211 static void
do_lookup_unique(const char * undef_name,unsigned int new_hash,struct link_map * map,struct sym_val * result,int type_class,const ElfW (Sym)* sym,const char * strtab,const ElfW (Sym)* ref,const struct link_map * undef_map,int flags)212 do_lookup_unique (const char *undef_name, unsigned int new_hash,
213 		  struct link_map *map, struct sym_val *result,
214 		  int type_class, const ElfW(Sym) *sym, const char *strtab,
215 		  const ElfW(Sym) *ref, const struct link_map *undef_map,
216 		  int flags)
217 {
218   /* We have to determine whether we already found a symbol with this
219      name before.  If not then we have to add it to the search table.
220      If we already found a definition we have to use it.  */
221 
222   struct unique_sym_table *tab
223     = &GL(dl_ns)[map->l_ns]._ns_unique_sym_table;
224 
225   __rtld_lock_lock_recursive (tab->lock);
226 
227   struct unique_sym *entries = tab->entries;
228   size_t size = tab->size;
229   if (entries != NULL)
230     {
231       size_t idx = new_hash % size;
232       size_t hash2 = 1 + new_hash % (size - 2);
233       while (1)
234 	{
235 	  if (entries[idx].hashval == new_hash
236 	      && strcmp (entries[idx].name, undef_name) == 0)
237 	    {
238 	      if ((type_class & ELF_RTYPE_CLASS_COPY) != 0)
239 		{
240 		  /* We possibly have to initialize the central
241 		     copy from the copy addressed through the
242 		     relocation.  */
243 		  result->s = sym;
244 		  result->m = map;
245 		}
246 	      else
247 		{
248 		  result->s = entries[idx].sym;
249 		  result->m = (struct link_map *) entries[idx].map;
250 		}
251 	      __rtld_lock_unlock_recursive (tab->lock);
252 	      return;
253 	    }
254 
255 	  if (entries[idx].name == NULL)
256 	    break;
257 
258 	  idx += hash2;
259 	  if (idx >= size)
260 	    idx -= size;
261 	}
262 
263       if (size * 3 <= tab->n_elements * 4)
264 	{
265 	  /* Expand the table.  */
266 #ifdef RTLD_CHECK_FOREIGN_CALL
267 	  /* This must not happen during runtime relocations.  */
268 	  assert (!RTLD_CHECK_FOREIGN_CALL);
269 #endif
270 	  size_t newsize = _dl_higher_prime_number (size + 1);
271 	  struct unique_sym *newentries
272 	    = calloc (sizeof (struct unique_sym), newsize);
273 	  if (newentries == NULL)
274 	    {
275 	    nomem:
276 	      __rtld_lock_unlock_recursive (tab->lock);
277 	      _dl_fatal_printf ("out of memory\n");
278 	    }
279 
280 	  for (idx = 0; idx < size; ++idx)
281 	    if (entries[idx].name != NULL)
282 	      enter_unique_sym (newentries, newsize, entries[idx].hashval,
283                                 entries[idx].name, entries[idx].sym,
284                                 entries[idx].map);
285 
286 	  tab->free (entries);
287 	  tab->size = newsize;
288 	  size = newsize;
289 	  entries = tab->entries = newentries;
290 	  tab->free = __rtld_free;
291 	}
292     }
293   else
294     {
295 #ifdef RTLD_CHECK_FOREIGN_CALL
296       /* This must not happen during runtime relocations.  */
297       assert (!RTLD_CHECK_FOREIGN_CALL);
298 #endif
299 
300 #define INITIAL_NUNIQUE_SYM_TABLE 31
301       size = INITIAL_NUNIQUE_SYM_TABLE;
302       entries = calloc (sizeof (struct unique_sym), size);
303       if (entries == NULL)
304 	goto nomem;
305 
306       tab->entries = entries;
307       tab->size = size;
308       tab->free = __rtld_free;
309     }
310 
311   if ((type_class & ELF_RTYPE_CLASS_COPY) != 0)
312     enter_unique_sym (entries, size, new_hash, strtab + sym->st_name, ref,
313 	   undef_map);
314   else
315     {
316       enter_unique_sym (entries, size,
317                         new_hash, strtab + sym->st_name, sym, map);
318 
319       if (map->l_type == lt_loaded && !is_nodelete (map, flags))
320 	{
321 	  /* Make sure we don't unload this object by
322 	     setting the appropriate flag.  */
323 	  if (__glibc_unlikely (GLRO (dl_debug_mask) & DL_DEBUG_BINDINGS))
324 	    _dl_debug_printf ("\
325 marking %s [%lu] as NODELETE due to unique symbol\n",
326 			      map->l_name, map->l_ns);
327 	  mark_nodelete (map, flags);
328 	}
329     }
330   ++tab->n_elements;
331 
332   __rtld_lock_unlock_recursive (tab->lock);
333 
334   result->s = sym;
335   result->m = (struct link_map *) map;
336 }
337 
338 /* Inner part of the lookup functions.  We return a value > 0 if we
339    found the symbol, the value 0 if nothing is found and < 0 if
340    something bad happened.  */
341 static int
342 __attribute_noinline__
do_lookup_x(const char * undef_name,unsigned int new_hash,unsigned long int * old_hash,const ElfW (Sym)* ref,struct sym_val * result,struct r_scope_elem * scope,size_t i,const struct r_found_version * const version,int flags,struct link_map * skip,int type_class,struct link_map * undef_map)343 do_lookup_x (const char *undef_name, unsigned int new_hash,
344 	     unsigned long int *old_hash, const ElfW(Sym) *ref,
345 	     struct sym_val *result, struct r_scope_elem *scope, size_t i,
346 	     const struct r_found_version *const version, int flags,
347 	     struct link_map *skip, int type_class, struct link_map *undef_map)
348 {
349   size_t n = scope->r_nlist;
350   /* Make sure we read the value before proceeding.  Otherwise we
351      might use r_list pointing to the initial scope and r_nlist being
352      the value after a resize.  That is the only path in dl-open.c not
353      protected by GSCOPE.  A read barrier here might be to expensive.  */
354   __asm volatile ("" : "+r" (n), "+m" (scope->r_list));
355   struct link_map **list = scope->r_list;
356 
357   do
358     {
359       const struct link_map *map = list[i]->l_real;
360 
361       /* Here come the extra test needed for `_dl_lookup_symbol_skip'.  */
362       if (map == skip)
363 	continue;
364 
365       /* Don't search the executable when resolving a copy reloc.  */
366       if ((type_class & ELF_RTYPE_CLASS_COPY) && map->l_type == lt_executable)
367 	continue;
368 
369       /* Do not look into objects which are going to be removed.  */
370       if (map->l_removed)
371 	continue;
372 
373       /* Print some debugging info if wanted.  */
374       if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_SYMBOLS))
375 	_dl_debug_printf ("symbol=%s;  lookup in file=%s [%lu]\n",
376 			  undef_name, DSO_FILENAME (map->l_name),
377 			  map->l_ns);
378 
379       /* If the hash table is empty there is nothing to do here.  */
380       if (map->l_nbuckets == 0)
381 	continue;
382 
383       Elf_Symndx symidx;
384       int num_versions = 0;
385       const ElfW(Sym) *versioned_sym = NULL;
386 
387       /* The tables for this map.  */
388       const ElfW(Sym) *symtab = (const void *) D_PTR (map, l_info[DT_SYMTAB]);
389       const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
390 
391       const ElfW(Sym) *sym;
392       const ElfW(Addr) *bitmask = map->l_gnu_bitmask;
393       if (__glibc_likely (bitmask != NULL))
394 	{
395 	  ElfW(Addr) bitmask_word
396 	    = bitmask[(new_hash / __ELF_NATIVE_CLASS)
397 		      & map->l_gnu_bitmask_idxbits];
398 
399 	  unsigned int hashbit1 = new_hash & (__ELF_NATIVE_CLASS - 1);
400 	  unsigned int hashbit2 = ((new_hash >> map->l_gnu_shift)
401 				   & (__ELF_NATIVE_CLASS - 1));
402 
403 	  if (__glibc_unlikely ((bitmask_word >> hashbit1)
404 				& (bitmask_word >> hashbit2) & 1))
405 	    {
406 	      Elf32_Word bucket = map->l_gnu_buckets[new_hash
407 						     % map->l_nbuckets];
408 	      if (bucket != 0)
409 		{
410 		  const Elf32_Word *hasharr = &map->l_gnu_chain_zero[bucket];
411 
412 		  do
413 		    if (((*hasharr ^ new_hash) >> 1) == 0)
414 		      {
415 			symidx = ELF_MACHINE_HASH_SYMIDX (map, hasharr);
416 			sym = check_match (undef_name, ref, version, flags,
417 					   type_class, &symtab[symidx], symidx,
418 					   strtab, map, &versioned_sym,
419 					   &num_versions);
420 			if (sym != NULL)
421 			  goto found_it;
422 		      }
423 		  while ((*hasharr++ & 1u) == 0);
424 		}
425 	    }
426 	  /* No symbol found.  */
427 	  symidx = SHN_UNDEF;
428 	}
429       else
430 	{
431 	  if (*old_hash == 0xffffffff)
432 	    *old_hash = _dl_elf_hash (undef_name);
433 
434 	  /* Use the old SysV-style hash table.  Search the appropriate
435 	     hash bucket in this object's symbol table for a definition
436 	     for the same symbol name.  */
437 	  for (symidx = map->l_buckets[*old_hash % map->l_nbuckets];
438 	       symidx != STN_UNDEF;
439 	       symidx = map->l_chain[symidx])
440 	    {
441 	      sym = check_match (undef_name, ref, version, flags,
442 				 type_class, &symtab[symidx], symidx,
443 				 strtab, map, &versioned_sym,
444 				 &num_versions);
445 	      if (sym != NULL)
446 		goto found_it;
447 	    }
448 	}
449 
450       /* If we have seen exactly one versioned symbol while we are
451 	 looking for an unversioned symbol and the version is not the
452 	 default version we still accept this symbol since there are
453 	 no possible ambiguities.  */
454       sym = num_versions == 1 ? versioned_sym : NULL;
455 
456       if (sym != NULL)
457 	{
458 	found_it:
459 	  /* Hidden and internal symbols are local, ignore them.  */
460 	  if (__glibc_unlikely (dl_symbol_visibility_binds_local_p (sym)))
461 	    goto skip;
462 
463 	  if (ELFW(ST_VISIBILITY) (sym->st_other) == STV_PROTECTED)
464 	    _dl_check_protected_symbol (undef_name, undef_map, ref, map,
465 					type_class);
466 
467 	  switch (ELFW(ST_BIND) (sym->st_info))
468 	    {
469 	    case STB_WEAK:
470 	      /* Weak definition.  Use this value if we don't find another.  */
471 	      if (__glibc_unlikely (GLRO(dl_dynamic_weak)))
472 		{
473 		  if (! result->s)
474 		    {
475 		      result->s = sym;
476 		      result->m = (struct link_map *) map;
477 		    }
478 		  break;
479 		}
480 	      /* FALLTHROUGH */
481 	    case STB_GLOBAL:
482 	      /* Global definition.  Just what we need.  */
483 	      result->s = sym;
484 	      result->m = (struct link_map *) map;
485 	      return 1;
486 
487 	    case STB_GNU_UNIQUE:;
488 	      do_lookup_unique (undef_name, new_hash, (struct link_map *) map,
489 				result, type_class, sym, strtab, ref,
490 				undef_map, flags);
491 	      return 1;
492 
493 	    default:
494 	      /* Local symbols are ignored.  */
495 	      break;
496 	    }
497 	}
498 
499 skip:
500       ;
501     }
502   while (++i < n);
503 
504   /* We have not found anything until now.  */
505   return 0;
506 }
507 
508 
509 /* Add extra dependency on MAP to UNDEF_MAP.  */
510 static int
add_dependency(struct link_map * undef_map,struct link_map * map,int flags)511 add_dependency (struct link_map *undef_map, struct link_map *map, int flags)
512 {
513   struct link_map *runp;
514   unsigned int i;
515   int result = 0;
516 
517   /* Avoid self-references and references to objects which cannot be
518      unloaded anyway.  */
519   if (undef_map == map)
520     return 0;
521 
522   /* Avoid references to objects which cannot be unloaded anyway.  We
523      do not need to record dependencies if this object goes away
524      during dlopen failure, either.  IFUNC resolvers with relocation
525      dependencies may pick an dependency which can be dlclose'd, but
526      such IFUNC resolvers are undefined anyway.  */
527   assert (map->l_type == lt_loaded);
528   if (is_nodelete (map, flags))
529     return 0;
530 
531   struct link_map_reldeps *l_reldeps
532     = atomic_forced_read (undef_map->l_reldeps);
533 
534   /* Make sure l_reldeps is read before l_initfini.  */
535   atomic_read_barrier ();
536 
537   /* Determine whether UNDEF_MAP already has a reference to MAP.  First
538      look in the normal dependencies.  */
539   struct link_map **l_initfini = atomic_forced_read (undef_map->l_initfini);
540   if (l_initfini != NULL)
541     {
542       for (i = 0; l_initfini[i] != NULL; ++i)
543 	if (l_initfini[i] == map)
544 	  return 0;
545     }
546 
547   /* No normal dependency.  See whether we already had to add it
548      to the special list of dynamic dependencies.  */
549   unsigned int l_reldepsact = 0;
550   if (l_reldeps != NULL)
551     {
552       struct link_map **list = &l_reldeps->list[0];
553       l_reldepsact = l_reldeps->act;
554       for (i = 0; i < l_reldepsact; ++i)
555 	if (list[i] == map)
556 	  return 0;
557     }
558 
559   /* Save serial number of the target MAP.  */
560   unsigned long long serial = map->l_serial;
561 
562   /* Make sure nobody can unload the object while we are at it.  */
563   if (__glibc_unlikely (flags & DL_LOOKUP_GSCOPE_LOCK))
564     {
565       /* We can't just call __rtld_lock_lock_recursive (GL(dl_load_lock))
566 	 here, that can result in ABBA deadlock.  */
567       THREAD_GSCOPE_RESET_FLAG ();
568       __rtld_lock_lock_recursive (GL(dl_load_lock));
569       /* While MAP value won't change, after THREAD_GSCOPE_RESET_FLAG ()
570 	 it can e.g. point to unallocated memory.  So avoid the optimizer
571 	 treating the above read from MAP->l_serial as ensurance it
572 	 can safely dereference it.  */
573       map = atomic_forced_read (map);
574 
575       /* From this point on it is unsafe to dereference MAP, until it
576 	 has been found in one of the lists.  */
577 
578       /* Redo the l_initfini check in case undef_map's l_initfini
579 	 changed in the mean time.  */
580       if (undef_map->l_initfini != l_initfini
581 	  && undef_map->l_initfini != NULL)
582 	{
583 	  l_initfini = undef_map->l_initfini;
584 	  for (i = 0; l_initfini[i] != NULL; ++i)
585 	    if (l_initfini[i] == map)
586 	      goto out_check;
587 	}
588 
589       /* Redo the l_reldeps check if undef_map's l_reldeps changed in
590 	 the mean time.  */
591       if (undef_map->l_reldeps != NULL)
592 	{
593 	  if (undef_map->l_reldeps != l_reldeps)
594 	    {
595 	      struct link_map **list = &undef_map->l_reldeps->list[0];
596 	      l_reldepsact = undef_map->l_reldeps->act;
597 	      for (i = 0; i < l_reldepsact; ++i)
598 		if (list[i] == map)
599 		  goto out_check;
600 	    }
601 	  else if (undef_map->l_reldeps->act > l_reldepsact)
602 	    {
603 	      struct link_map **list
604 		= &undef_map->l_reldeps->list[0];
605 	      i = l_reldepsact;
606 	      l_reldepsact = undef_map->l_reldeps->act;
607 	      for (; i < l_reldepsact; ++i)
608 		if (list[i] == map)
609 		  goto out_check;
610 	    }
611 	}
612     }
613   else
614     __rtld_lock_lock_recursive (GL(dl_load_lock));
615 
616   /* The object is not yet in the dependency list.  Before we add
617      it make sure just one more time the object we are about to
618      reference is still available.  There is a brief period in
619      which the object could have been removed since we found the
620      definition.  */
621   runp = GL(dl_ns)[undef_map->l_ns]._ns_loaded;
622   while (runp != NULL && runp != map)
623     runp = runp->l_next;
624 
625   if (runp != NULL)
626     {
627       /* The object is still available.  */
628 
629       /* MAP could have been dlclosed, freed and then some other dlopened
630 	 library could have the same link_map pointer.  */
631       if (map->l_serial != serial)
632 	goto out_check;
633 
634       /* Redo the NODELETE check, as when dl_load_lock wasn't held
635 	 yet this could have changed.  */
636       if (is_nodelete (map, flags))
637 	goto out;
638 
639       /* If the object with the undefined reference cannot be removed ever
640 	 just make sure the same is true for the object which contains the
641 	 definition.  */
642       if (undef_map->l_type != lt_loaded || is_nodelete (map, flags))
643 	{
644 	  if (__glibc_unlikely (GLRO (dl_debug_mask) & DL_DEBUG_BINDINGS)
645 	      && !is_nodelete (map, flags))
646 	    {
647 	      if (undef_map->l_name[0] == '\0')
648 		_dl_debug_printf ("\
649 marking %s [%lu] as NODELETE due to reference from main program\n",
650 				  map->l_name, map->l_ns);
651 	      else
652 		_dl_debug_printf ("\
653 marking %s [%lu] as NODELETE due to reference from %s [%lu]\n",
654 				  map->l_name, map->l_ns,
655 				  undef_map->l_name, undef_map->l_ns);
656 	    }
657 	  mark_nodelete (map, flags);
658 	  goto out;
659 	}
660 
661       /* Add the reference now.  */
662       if (__glibc_unlikely (l_reldepsact >= undef_map->l_reldepsmax))
663 	{
664 	  /* Allocate more memory for the dependency list.  Since this
665 	     can never happen during the startup phase we can use
666 	     `realloc'.  */
667 	  struct link_map_reldeps *newp;
668 	  unsigned int max
669 	    = undef_map->l_reldepsmax ? undef_map->l_reldepsmax * 2 : 10;
670 
671 #ifdef RTLD_PREPARE_FOREIGN_CALL
672 	  RTLD_PREPARE_FOREIGN_CALL;
673 #endif
674 
675 	  newp = malloc (sizeof (*newp) + max * sizeof (struct link_map *));
676 	  if (newp == NULL)
677 	    {
678 	      /* If we didn't manage to allocate memory for the list this is
679 		 no fatal problem.  We simply make sure the referenced object
680 		 cannot be unloaded.  This is semantically the correct
681 		 behavior.  */
682 	      if (__glibc_unlikely (GLRO (dl_debug_mask) & DL_DEBUG_BINDINGS)
683 		  && !is_nodelete (map, flags))
684 		_dl_debug_printf ("\
685 marking %s [%lu] as NODELETE due to memory allocation failure\n",
686 				  map->l_name, map->l_ns);
687 	      /* In case of non-lazy binding, we could actually report
688 		 the memory allocation error, but for now, we use the
689 		 conservative approximation as well.  */
690 	      mark_nodelete (map, flags);
691 	      goto out;
692 	    }
693 	  else
694 	    {
695 	      if (l_reldepsact)
696 		memcpy (&newp->list[0], &undef_map->l_reldeps->list[0],
697 			l_reldepsact * sizeof (struct link_map *));
698 	      newp->list[l_reldepsact] = map;
699 	      newp->act = l_reldepsact + 1;
700 	      atomic_write_barrier ();
701 	      void *old = undef_map->l_reldeps;
702 	      undef_map->l_reldeps = newp;
703 	      undef_map->l_reldepsmax = max;
704 	      if (old)
705 		_dl_scope_free (old);
706 	    }
707 	}
708       else
709 	{
710 	  undef_map->l_reldeps->list[l_reldepsact] = map;
711 	  atomic_write_barrier ();
712 	  undef_map->l_reldeps->act = l_reldepsact + 1;
713 	}
714 
715       /* Display information if we are debugging.  */
716       if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_FILES))
717 	_dl_debug_printf ("\
718 \nfile=%s [%lu];  needed by %s [%lu] (relocation dependency)\n\n",
719 			  DSO_FILENAME (map->l_name),
720 			  map->l_ns,
721 			  DSO_FILENAME (undef_map->l_name),
722 			  undef_map->l_ns);
723     }
724   else
725     /* Whoa, that was bad luck.  We have to search again.  */
726     result = -1;
727 
728  out:
729   /* Release the lock.  */
730   __rtld_lock_unlock_recursive (GL(dl_load_lock));
731 
732   if (__glibc_unlikely (flags & DL_LOOKUP_GSCOPE_LOCK))
733     THREAD_GSCOPE_SET_FLAG ();
734 
735   return result;
736 
737  out_check:
738   if (map->l_serial != serial)
739     result = -1;
740   goto out;
741 }
742 
743 
744 /* Search loaded objects' symbol tables for a definition of the symbol
745    UNDEF_NAME, perhaps with a requested version for the symbol.
746 
747    We must never have calls to the audit functions inside this function
748    or in any function which gets called.  If this would happen the audit
749    code might create a thread which can throw off all the scope locking.  */
750 lookup_t
_dl_lookup_symbol_x(const char * undef_name,struct link_map * undef_map,const ElfW (Sym)** ref,struct r_scope_elem * symbol_scope[],const struct r_found_version * version,int type_class,int flags,struct link_map * skip_map)751 _dl_lookup_symbol_x (const char *undef_name, struct link_map *undef_map,
752 		     const ElfW(Sym) **ref,
753 		     struct r_scope_elem *symbol_scope[],
754 		     const struct r_found_version *version,
755 		     int type_class, int flags, struct link_map *skip_map)
756 {
757   const unsigned int new_hash = _dl_new_hash (undef_name);
758   unsigned long int old_hash = 0xffffffff;
759   struct sym_val current_value = { NULL, NULL };
760   struct r_scope_elem **scope = symbol_scope;
761 
762   bump_num_relocations ();
763 
764   /* DL_LOOKUP_RETURN_NEWEST does not make sense for versioned
765      lookups.  */
766   assert (version == NULL || !(flags & DL_LOOKUP_RETURN_NEWEST));
767 
768   size_t i = 0;
769   if (__glibc_unlikely (skip_map != NULL))
770     /* Search the relevant loaded objects for a definition.  */
771     while ((*scope)->r_list[i] != skip_map)
772       ++i;
773 
774   /* Search the relevant loaded objects for a definition.  */
775   for (size_t start = i; *scope != NULL; start = 0, ++scope)
776     if (do_lookup_x (undef_name, new_hash, &old_hash, *ref,
777 		     &current_value, *scope, start, version, flags,
778 		     skip_map, type_class, undef_map) != 0)
779       break;
780 
781   if (__glibc_unlikely (current_value.s == NULL))
782     {
783       if ((*ref == NULL || ELFW(ST_BIND) ((*ref)->st_info) != STB_WEAK)
784 	  && !(GLRO(dl_debug_mask) & DL_DEBUG_UNUSED))
785 	{
786 	  /* We could find no value for a strong reference.  */
787 	  const char *reference_name = undef_map ? undef_map->l_name : "";
788 	  const char *versionstr = version ? ", version " : "";
789 	  const char *versionname = (version && version->name
790 				     ? version->name : "");
791 	  struct dl_exception exception;
792 	  /* XXX We cannot translate the message.  */
793 	  _dl_exception_create_format
794 	    (&exception, DSO_FILENAME (reference_name),
795 	     "undefined symbol: %s%s%s",
796 	     undef_name, versionstr, versionname);
797 	  _dl_signal_cexception (0, &exception, N_("symbol lookup error"));
798 	  _dl_exception_free (&exception);
799 	}
800       *ref = NULL;
801       return 0;
802     }
803 
804   int protected = (*ref
805 		   && ELFW(ST_VISIBILITY) ((*ref)->st_other) == STV_PROTECTED);
806   if (__glibc_unlikely (protected != 0))
807     {
808       /* It is very tricky.  We need to figure out what value to
809 	 return for the protected symbol.  */
810       if (type_class == ELF_RTYPE_CLASS_PLT)
811 	{
812 	  if (current_value.s != NULL && current_value.m != undef_map)
813 	    {
814 	      current_value.s = *ref;
815 	      current_value.m = undef_map;
816 	    }
817 	}
818       else
819 	{
820 	  struct sym_val protected_value = { NULL, NULL };
821 
822 	  for (scope = symbol_scope; *scope != NULL; i = 0, ++scope)
823 	    if (do_lookup_x (undef_name, new_hash, &old_hash, *ref,
824 			     &protected_value, *scope, i, version, flags,
825 			     skip_map, ELF_RTYPE_CLASS_PLT, NULL) != 0)
826 	      break;
827 
828 	  if (protected_value.s != NULL && protected_value.m != undef_map)
829 	    {
830 	      current_value.s = *ref;
831 	      current_value.m = undef_map;
832 	    }
833 	}
834     }
835 
836   /* We have to check whether this would bind UNDEF_MAP to an object
837      in the global scope which was dynamically loaded.  In this case
838      we have to prevent the latter from being unloaded unless the
839      UNDEF_MAP object is also unloaded.  */
840   if (__glibc_unlikely (current_value.m->l_type == lt_loaded)
841       /* Don't do this for explicit lookups as opposed to implicit
842 	 runtime lookups.  */
843       && (flags & DL_LOOKUP_ADD_DEPENDENCY) != 0
844       /* Add UNDEF_MAP to the dependencies.  */
845       && add_dependency (undef_map, current_value.m, flags) < 0)
846       /* Something went wrong.  Perhaps the object we tried to reference
847 	 was just removed.  Try finding another definition.  */
848       return _dl_lookup_symbol_x (undef_name, undef_map, ref,
849 				  (flags & DL_LOOKUP_GSCOPE_LOCK)
850 				  ? undef_map->l_scope : symbol_scope,
851 				  version, type_class, flags, skip_map);
852 
853   /* The object is used.  */
854   if (__glibc_unlikely (current_value.m->l_used == 0))
855     current_value.m->l_used = 1;
856 
857   *ref = current_value.s;
858   return LOOKUP_VALUE (current_value.m);
859 }
860