[Bug dynamic-link/32412] TLS realloc's DTV breaking invariant

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=32412

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Interesting bug, and great analysis.

This should fix it. A proper patch needs a test case, of course.

diff --git a/elf/dl-tls.c b/elf/dl-tls.c
index 3d529b722c..b13e752358 100644
--- a/elf/dl-tls.c
+++ b/elf/dl-tls.c
@@ -528,6 +528,13 @@ _dl_resize_dtv (dtv_t *dtv, size_t max_modid)
       if (newp == NULL)
        oom ();
       memcpy (newp, &dtv[-1], (2 + oldsize) * sizeof (dtv_t));
+#ifdef SHARED
+      /* Auditors can trigger a DTV resize event while the full malloc
+        is not yet in use.  Mark the new DTV allocation as the
+        initial allocation.  */
+      if (!__rtld_malloc_is_complete ())
+       GL(dl_initial_dtv) = &newp[1];
+#endif
     }
   else
     {

-- 
You are receiving this mail because:
You are on the CC list for the bug.