Fix a bundled-zstd symbol clash inside a Node addon by rebinding only those relocation slots (instead of RTLD_DEEPBIND)
Problem: a closed-source .so loaded by a Node addon bundles its own old zstd with default visibility. Node >= 23.8 exports its zstd from the executable, so ld.so binds part of the library's ZSTD_/HUF_ references to Node's newer copy. Its static internals stay on the old one, and its compress path segfaulted. -lzstd link order only swaps in the system libzstd, which is still mixed. RTLD_DEEPBIND on the library fixed zstd but also rebound its operator new/delete and __cxa_* to its private C++ runtime copy.
Fix that worked (glibc, x86-64): at addon init, before any use, dl_iterate_phdr over loaded objects (skip the main program). 1. Read PT_DYNAMIC: DT_SYMTAB, DT_STRTAB, DT_RELA/RELASZ, DT_JMPREL/PLTRELSZ. The loader has already relocated these d_ptr values in place. 2. For R_X86_64_GLOB_DAT, JUMP_SLOT and 64 relocations whose symbol name matches the family, and which the object defines itself (st_shndx != UNDEF), write base+st_value (+addend for R_64) into the slot. 3. Slots inside PT_GNU_RELRO need mprotect RW around the write, then back to PROT_READ.
Verify with a live-slot check, not LD_DEBUG=bindings, which keeps logging the loader's original choice: run under LD_BIND_NOW=1, read each slot through /proc/self/mem, and map the value to an object through /proc/self/maps. Also round-trip data through the library's own ZSTD_compress/ZSTD_decompress (dlopen RTLD_NOLOAD + dlsym on its handle returns its own definitions) and cross-check against Node's zlib.zstdDecompressSync.
Result: 182/182 slots own, round trips pass, no measurable cost. Under lazy binding, unresolved PLT slots get rewritten too, so they never resolve to the other copy.
Review follow-up (glibc x86-64, Node 24): a prefix family (ZSTD_/HUF_/FSE_/ZSTDMT_/ZBUFF_/ZDICT_/POOL_) misses zstd's ERR_getErrorString (from error_private.c), which an old bundled zstd exports unprefixed and which Node also exports, so that one slot stays on Node's copy. Add it by exact name, not as an ERR_ prefix: the node binary also exports OpenSSL's ERR_*. Also don't let the verification check share the fix's name list. Report every symbol an object defines whose live slot points at another object, with an allowlist for the C++ runtime (__cxa_*, __gxx_personality_v0, __dynamic_cast, _Z*). In that run it was 20 slots: 19 libstdc++ and the one zstd miss. Two latent cases worth guarding: a non-RELRO slot in a read-only segment (DT_TEXTREL objects) needs a PF_W check before writing, and when PT_GNU_RELRO's end is not page-aligned, ld.so only protects up to the aligned-down end, so restoring PROT_READ on that last page would make writable data read-only.
Follow-up on restoring page protections after rewriting slots: don't assume RW-then-R. Take each page's original protection from its PT_LOAD p_flags (PF_R/PF_W/PF_X), except inside PT_GNU_RELRO, where the loader leaves exactly PROT_READ on the page-rounded range (glibc _dl_protect_relro). Write with that protection | PROT_WRITE, then restore exactly the original. That keeps PROT_EXEC on a TEXTREL code page, so code on the page keeps running. Two edges: (1) if two PT_LOADs share a page, the loader's later MAP_FIXED mapping wins, so use the last PT_LOAD covering the page (or read /proc/self/maps) rather than the first match; (2) on hosts that forbid W+X, mprotect fails, so count that slot as failed and skip it instead of crashing. Check with strace -e trace=mprotect, and use a tiny victim .so per layout (plain, RELRO ending mid-page, TEXTREL).