android_get_exported_namespace: acquire g_dl_mutex
android_get_exported_namespace searches g_exported_namespaces, which
isn't modified after process initialization, but it does the search
using a new std::string object, and the linker's malloc/free functions
aren't thread-safe. (They're protected by the same lock (g_dl_mutex) as
the rest of the linker's state.)
Bug: http://b/150372650
Test: bionic-unit-tests
Change-Id: Iafd12e5ab36ae61f0642aad59939f528d31bda16
diff --git a/linker/dlfcn.cpp b/linker/dlfcn.cpp
index 228e30a..255363f 100644
--- a/linker/dlfcn.cpp
+++ b/linker/dlfcn.cpp
@@ -279,6 +279,7 @@
}
android_namespace_t* __loader_android_get_exported_namespace(const char* name) {
+ ScopedPthreadMutexLocker locker(&g_dl_mutex);
return get_exported_namespace(name);
}