1 files changed, 172 insertions, 46 deletions

diff --git a/src/lib/libc/stdlib/atexit.c b/src/lib/libc/stdlib/atexit.c
index 4da1eb0d9c..049da3261d 100644
--- a/src/lib/libc/stdlib/atexit.c
+++ b/src/lib/libc/stdlib/atexit.c
@@ -1,68 +1,194 @@
-/*-
- * Copyright (c) 1990 The Regents of the University of California.
+/*      $OpenBSD: atexit.c,v 1.17 2013/12/28 18:38:42 kettenis Exp $ */
+/*
+ * Copyright (c) 2002 Daniel Hartmeier
  * All rights reserved.
  *
- * This code is derived from software contributed to Berkeley by
- * Chris Torek.
- *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
  *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
+ *    - Redistributions of source code must retain the above copyright
+ *      notice, this list of conditions and the following disclaimer.
+ *    - Redistributions in binary form must reproduce the above
+ *      copyright notice, this list of conditions and the following
+ *      disclaimer in the documentation and/or other materials provided
+ *      with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
+ * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-/*static char *sccsid = "from: @(#)atexit.c     5.2 (Berkeley) 11/14/90";*/
-static char *rcsid = "$Id: atexit.c,v 1.1.1.1 1995/10/18 08:42:16 deraadt Exp $";
-#endif /* LIBC_SCCS and not lint */
-
+#include <sys/types.h>
+#include <sys/mman.h>
 #include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
 #include "atexit.h"
+#include "thread_private.h"
 
 struct atexit *__atexit;
 
 /*
- * Register a function to be performed at exit.
+ * Function pointers are stored in a linked list of pages. The list
+ * is initially empty, and pages are allocated on demand. The first
+ * function pointer in the first allocated page (the last one in
+ * the linked list) is reserved for the cleanup function.
+ *
+ * Outside the following functions, all pages are mprotect()'ed
+ * to prevent unintentional/malicious corruption.
+ */
+
+/*
+ * Register a function to be performed at exit or when a shared object
+ * with the given dso handle is unloaded dynamically.  Also used as
+ * the backend for atexit().  For more info on this API, see:
+ *
+ *      http://www.codesourcery.com/cxx-abi/abi.html#dso-dtor
  */
 int
-atexit(fn)
-        void (*fn)();
+__cxa_atexit(void (*func)(void *), void *arg, void *dso)
 {
-        static struct atexit __atexit0; /* one guaranteed table */
-        register struct atexit *p;
+        struct atexit *p = __atexit;
+        struct atexit_fn *fnp;
+        int pgsize = getpagesize();
+        int ret = -1;
 
-        if ((p = __atexit) == NULL)
-                __atexit = p = &__atexit0;
-        else if (p->ind >= ATEXIT_SIZE) {
-                if ((p = malloc(sizeof(*p))) == NULL)
-                        return (-1);
-                p->ind = 0;
+        if (pgsize < sizeof(*p))
+                return (-1);
+        _ATEXIT_LOCK();
+        p = __atexit;
+        if (p != NULL) {
+                if (p->ind + 1 >= p->max)
+                        p = NULL;
+                else if (mprotect(p, pgsize, PROT_READ | PROT_WRITE))
+                        goto unlock;
+        }
+        if (p == NULL) {
+                p = mmap(NULL, pgsize, PROT_READ | PROT_WRITE,
+                    MAP_ANON | MAP_PRIVATE, -1, 0);
+                if (p == MAP_FAILED)
+                        goto unlock;
+                if (__atexit == NULL) {
+                        memset(&p->fns[0], 0, sizeof(p->fns[0]));
+                        p->ind = 1;
+                } else
+                        p->ind = 0;
+                p->max = (pgsize - ((char *)&p->fns[0] - (char *)p)) /
+                    sizeof(p->fns[0]);
                 p->next = __atexit;
                 __atexit = p;
         }
-        p->fns[p->ind++] = fn;
-        return (0);
+        fnp = &p->fns[p->ind++];
+        fnp->fn_ptr.cxa_func = func;
+        fnp->fn_arg = arg;
+        fnp->fn_dso = dso;
+        if (mprotect(p, pgsize, PROT_READ))
+                goto unlock;
+        ret = 0;
+unlock:
+        _ATEXIT_UNLOCK();
+        return (ret);
+}
+
+/*
+ * Call all handlers registered with __cxa_atexit() for the shared
+ * object owning 'dso'.
+ * Note: if 'dso' is NULL, then all remaining handlers are called.
+ */
+void
+__cxa_finalize(void *dso)
+{
+        struct atexit *p, *q;
+        struct atexit_fn fn;
+        int n, pgsize = getpagesize();
+        static int call_depth;
+
+        call_depth++;
+
+        for (p = __atexit; p != NULL; p = p->next) {
+                for (n = p->ind; --n >= 0;) {
+                        if (p->fns[n].fn_ptr.cxa_func == NULL)
+                                continue;       /* already called */
+                        if (dso != NULL && dso != p->fns[n].fn_dso)
+                                continue;       /* wrong DSO */
+
+                        /*
+                         * Mark handler as having been already called to avoid
+                         * dupes and loops, then call the appropriate function.
+                         */
+                        fn = p->fns[n];
+                        if (mprotect(p, pgsize, PROT_READ | PROT_WRITE) == 0) {
+                                p->fns[n].fn_ptr.cxa_func = NULL;
+                                mprotect(p, pgsize, PROT_READ);
+                        }
+                        if (fn.fn_dso != NULL)
+                                (*fn.fn_ptr.cxa_func)(fn.fn_arg);
+                        else
+                                (*fn.fn_ptr.std_func)();
+                }
+        }
+
+        call_depth--;
+
+        /*
+         * If called via exit(), unmap the pages since we have now run
+         * all the handlers.  We defer this until calldepth == 0 so that
+         * we don't unmap things prematurely if called recursively.
+         */
+        if (dso == NULL && call_depth == 0) {
+                for (p = __atexit; p != NULL; ) {
+                        q = p;
+                        p = p->next;
+                        munmap(q, pgsize);
+                }
+                __atexit = NULL;
+        }
+}
+
+/*
+ * Register the cleanup function
+ */
+void
+__atexit_register_cleanup(void (*func)(void))
+{
+        struct atexit *p;
+        int pgsize = getpagesize();
+
+        if (pgsize < sizeof(*p))
+                return;
+        _ATEXIT_LOCK();
+        p = __atexit;
+        while (p != NULL && p->next != NULL)
+                p = p->next;
+        if (p == NULL) {
+                p = mmap(NULL, pgsize, PROT_READ | PROT_WRITE,
+                    MAP_ANON | MAP_PRIVATE, -1, 0);
+                if (p == MAP_FAILED)
+                        goto unlock;
+                p->ind = 1;
+                p->max = (pgsize - ((char *)&p->fns[0] - (char *)p)) /
+                    sizeof(p->fns[0]);
+                p->next = NULL;
+                __atexit = p;
+        } else {
+                if (mprotect(p, pgsize, PROT_READ | PROT_WRITE))
+                        goto unlock;
+        }
+        p->fns[0].fn_ptr.std_func = func;
+        p->fns[0].fn_arg = NULL;
+        p->fns[0].fn_dso = NULL;
+        mprotect(p, pgsize, PROT_READ);
+unlock:
+        _ATEXIT_UNLOCK();
 }