[PATCH] elf: Fix leak in _dl_scope_free

[ningle]

_dl_scope_free uses a free-list to delay freeing scope pointers until
THREAD_GSCOPE_WAIT has ensured safety.  In the multi-threaded case,
pointers are queued in dl_scope_free_list until the list is full.

When the free-list is already full on entry, the current code calls
THREAD_GSCOPE_WAIT and frees all pointers in the list, but ignores the
pointer passed to this _dl_scope_free call (OLD): it is neither added
to the list nor freed, causing a leak.

Fix this by, after flushing the full list, storing OLD in list[0] and
setting count to 1, so OLD becomes the first element of the next
batch and will be freed in a later flush.

* elf/dl-XXX.c (_dl_scope_free): When the free-list is full, flush it,
  then enqueue OLD as the first element instead of dropping it.

Signed-off-by: ningle <ning.le@h3c.com>
---
 elf/dl-scope.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/elf/dl-scope.c b/elf/dl-scope.c
index 4fc028e6..2d666227 100644
--- a/elf/dl-scope.c
+++ b/elf/dl-scope.c
@@ -50,7 +50,11 @@ _dl_scope_free (void *old)
     {
       THREAD_GSCOPE_WAIT ();
       while (fsl->count > 0)
-	free (fsl->list[--fsl->count]);
+        {
+          free (fsl->list[--fsl->count]);
+        }
+      fsl->list[0] = old;
+      fsl->count = 1;
       return 1;
     }
   return 0;
-- 
2.33.0