Skip to content

[CORE] Add MallocHookRun to call startMallocHook before RunElfInit#3999

Merged
ptitSeb merged 1 commit into
ptitSeb:mainfrom
zengdage:MallocHookRun
Jul 1, 2026
Merged

[CORE] Add MallocHookRun to call startMallocHook before RunElfInit#3999
ptitSeb merged 1 commit into
ptitSeb:mainfrom
zengdage:MallocHookRun

Conversation

@zengdage

@zengdage zengdage commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

The startMallocHook function is only invoked inside RunElfInit, and RunElfInit is only called for the main ELF binary within __libc_start_main.

In the RunElfInit function, startMallocHook is currently invoked only after all initialization routines of dynamic libraries have been executed. However, if the malloc hook is defined within a dependent library and that library’s initialization routine invokes the malloc hook interface, activation of the malloc hook will be delayed, leading to unexpected runtime exceptions.

Therefore, I add a call to MallocHookRun so that the malloc hook can be available before the execution of library init functions.

Before:

__libc_start_main
    |
    ---> RunElfInit
             |
             ----> libA.so Init
             |          |
             |          ---> _Znam
             |                 |
             |                 ---> Native actual_malloc
             ---> startMallocHook

After:

__libc_start_main
    |
    ---> MallocHookRun
    |        |
    |        ---> startMallocHook
    |
    ---> RunElfInit
             |
             ----> libA.so Init
                       |
                       ---> _Znam
                              |
                              ---> X86-64 real_malloc

The `startMallocHook` function is only invoked inside `RunElfInit`, and
`RunElfInit` is only called for the main ELF binary within `__libc_start_main`.

In the `RunElfInit` function, `startMallocHook` is currently invoked only after
all initialization routines of dynamic libraries have been executed. However,
if the malloc hook is defined within a dependent library and that library’s
initialization routine invokes the malloc hook interface, activation of the
malloc hook will be delayed, leading to unexpected runtime exceptions.

Therefore, I add a call to `MallocHookRun` so that the malloc hook can be
available before the execution of library init functions.

Before:
```
__libc_start_main
    |
    ---> RunElfInit
             |
             ----> libA.so Init
             |          |
             |          ---> _Znam
             |                 |
             |                 ---> Native actual_malloc
             ---> startMallocHook
```

After:
```
__libc_start_main
    |
    ---> MallocHookRun
    |        |
    |        ---> startMallocHook
    |
    ---> RunElfInit
             |
             ----> libA.so Init
                       |
                       ---> _Znam
                              |
                              ---> X86-64 real_malloc
```
@zengdage

zengdage commented Jul 1, 2026

Copy link
Copy Markdown
Contributor Author

I found this issue while analyzing startup crashes of x86-64 Linux WeChat (An IM app developed by Tencent) running on RISC-V Linux.

@ptitSeb ptitSeb merged commit 2f850d4 into ptitSeb:main Jul 1, 2026
28 checks passed
@ptitSeb

ptitSeb commented Jul 1, 2026

Copy link
Copy Markdown
Owner

Ok, make sense, thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants