Also set r->r_map when unmapping the first object in a namespace.

When unmapping the first object in a namespace, the runtime linker
did not update the externally visible pointer.  This resulted in
debuggers seeing pointers to memory that had been freed.

diff --git a/ChangeLog b/ChangeLog
index 6cb87f2..ba4ea36 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-08-16  Gary Benson  <gbenson@redhat.com>
+
+       * elf/dl-close.c (_dl_close_worker): Also set r->r_map when
+       unmapping the first object in a namespace.
+
 2012-08-16  Roland McGrath  <roland@hack.frob.com>
 
        * inet/getnetgrent_r.c (internal_setnetgrent): Renamed to ...

diff --git a/elf/dl-close.c b/elf/dl-close.c
index 45b2187..216bd81 100644 (file)
--- a/elf/dl-close.c
+++ b/elf/dl-close.c
@@ -641,7 +641,7 @@ _dl_close_worker (struct link_map *map)
 #ifdef SHARED
              assert (nsid != LM_ID_BASE);
 #endif
-             ns->_ns_loaded = imap->l_next;
+             r->r_map = ns->_ns_loaded = imap->l_next;
            }
 
          --ns->_ns_nloaded;