| Summary: | dtv setup at thread creation may leave an entry uninitialized | ||
|---|---|---|---|
| Product: | glibc | Reporter: | Szabolcs Nagy <nsz> |
| Component: | dynamic-link | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | ||
| Priority: | P2 | ||
| Version: | 2.32 | ||
| Target Milestone: | 2.34 | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d2b997c7172e9a00895a9deb379f8782fbd2e36f commit d2b997c7172e9a00895a9deb379f8782fbd2e36f Author: Szabolcs Nagy <szabolcs.nagy@arm.com> Date: Wed Dec 30 23:40:14 2020 +0000 elf: Fix a DTV setup issue [BZ #27136] The max modid is a valid index in the dtv, it should not be skipped. The bug is observable if the last module has modid == 64 and its generation is same or less than the max generation of the previous modules. Then dtv[0].counter implies dtv[64] is initialized but it isn't. Fixes bug 27136. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8f85075a2e9c26ff7486d4bbaf358999807d215c commit 8f85075a2e9c26ff7486d4bbaf358999807d215c Author: Szabolcs Nagy <szabolcs.nagy@arm.com> Date: Thu Dec 31 12:24:38 2020 +0000 elf: Add a DTV setup test [BZ #27136] The test dlopens a large number of modules with TLS, they are reused from an existing test. The test relies on the reuse of slotinfo entries after dlclose, without bug 27135 fixed this needs a failing dlopen. With a slotinfo list that has non-monotone increasing generation counters, bug 27136 can trigger. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> fixed for 2.34. the test cases needed a fix, see commit https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=52290d8c04569615fb011ee286d52dc5147afbd7 |
dtv setup is supposed to fill in all dtv entries up to the generation count stored in dtv[0]. otherwise tls access can segfault with null ptr dereference. under rare circumstances the last module in the list may be left uninitialized because of a logic error in _dl_allocate_tls_init. the fix is - if (total >= GL(dl_tls_max_dtv_idx)) + if (total > GL(dl_tls_max_dtv_idx)) break; the max id is a valid index, so it should be checked and not skipped. i think the error happens if 64 modules are loaded with tls and the last one is loaded as a dependency of the previous module: mod63 and mod64 have the same tls generation count but mod64 is on a new slotinfo node. in that case the generation of the dtv will be the same as mod64, but dtv[64] will not be initialized. if modids are reused (see bug 27135) then mod64 can have lower generation than mod63 and can be an independently loaded module so the issue is easier to hit.