Skip to content

Commit

Permalink
fix native code crash when calling unloaded module with on_load function
Browse files Browse the repository at this point in the history
As reported in erlang-bugs, the following sequence of events crashes the VM:

1. Module M1 is loaded and in native mode.
2. Module M2 is not loaded, in emulated mode, and has an on_load function.
3. M1 calls some function in M2. This works.
4. M1 again calls some function in M2. This segfaults.

The reason for the crash is that when the beam loader fixes up export
entries after a successful on_load function call, it erroneously clears
the ->code[3] field in that module's export entries.  This is redundant
(no code in beam relies on ->code[3] being NULL), inconsistent with
modules without on_load functions (there ->code[3] remains a valid beam
instruction after the module is loaded), and breaks native code which needs
the old ->address value in an export entry to remain valid after a module
load step (before the load ->address points to ->code[3], after the load
->address points to the real code but uses of the old ->address value
remain so ->code[3] must remain valid).

Thus the fix for the crash is to simply not clear ->code[3].
This patch fixes R14A and should also fix R13B04.

(There does exist a performance bug in this area, but it is unrelated
to the on_load feature so will be fixed separately.)
  • Loading branch information
Mikael Pettersson authored and bjorng committed Aug 27, 2010
1 parent 980773b commit 9010837
Showing 1 changed file with 0 additions and 1 deletion.
1 change: 0 additions & 1 deletion erts/emulator/beam/beam_bif_load.c
Expand Up @@ -337,7 +337,6 @@ BIF_RETTYPE finish_after_on_load_2(BIF_ALIST_2)
ep->code[0] == BIF_ARG_1 &&
ep->code[4] != 0) {
ep->address = (void *) ep->code[4];
ep->code[3] = 0;
ep->code[4] = 0;
}
}
Expand Down

0 comments on commit 9010837

Please sign in to comment.