[PATCH] aarch64: Use explicit offsets in _dl_tlsdesc_dynamic

[Florian Weimer]

On 12/02/2016 12:52 PM, Florian Weimer wrote:

> I have a test case which triggers a crash on aarch64, but I'm not yet
> sure if it actually covers this bug.  It fails even with the fix above.
> valground still shows an OOB write in TLS data:
>
> ==16070== Invalid write of size 8
> ==16070==    at 0x4897C9C: init_one_static_tls (allocatestack.c:1196)
> ==16070==    by 0x4897C9C: __pthread_init_static_tls (allocatestack.c:1213)
> ==16070==    by 0x18A1CB: _dl_try_allocate_static_tls (dl-reloc.c:106)
> ==16070==    by 0x19383F: _dl_tlsdesc_resolve_rela_fixup (tlsdesc.c:104)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==    by 0x193B03: _dl_tlsdesc_resolve_rela (dl-tlsdesc.S:288)
> ==16070==  Address 0x5240158 is 8 bytes after a block of size 272 alloc'd
> ==16070==    at 0x4835D4C: calloc (vg_replace_malloc.c:711)
> ==16070==    by 0x18F9CF: allocate_dtv (dl-tls.c:322)
> ==16070==    by 0x190117: _dl_allocate_tls (dl-tls.c:570)
> ==16070==    by 0x4898D4B: allocate_stack (allocatestack.c:578)
> ==16070==    by 0x4898D4B: pthread_create@@GLIBC_2.17
> (pthread_create.c:539)
> ==16070==    by 0x401CCB: xpthread_create (test-skeleton.c:691)
> ==16070==    by 0x401CCB: do_test (tst-tls-manydynamic.c:97)
> ==16070==    by 0x4018CF: main (test-skeleton.c:539)
>
> I need to check if this happens before the ILP32 enablement patch, too.

It's something else.  I do not know yet if this is a bug caused by the 
Red Hat Enterprise Linux 7 system compiler.  The system glibc does not 
have this issue.

I will commit both original bug fix (because it is an obvious 
improvement) and this new test soon, and separately, unless someone 
objects.  To be on the safe side, I have eliminated cancellation and any 
potential dlopen/pthread_create race from the test.

Thanks,
Florian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: aarch64-tls.patch
Type: text/x-patch
Size: 14076 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20161202/1df08d96/attachment.bin>