[Bug dynamic-link/17090] New: Assertion failure (map->l_tls_modid == cnt) when dlopen()ing initial-exec TLS shared objects under certain circumstances

["tudorb at gmail dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=17090

            Bug ID: 17090
           Summary: Assertion failure (map->l_tls_modid == cnt) when
                    dlopen()ing initial-exec TLS shared objects under
                    certain circumstances
           Product: glibc
           Version: 2.19
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: tudorb at gmail dot com

Created attachment 7658
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7658&action=edit
test case

When loading an initial-exec TLS object after the initial segment of
dl_tls_dtv_slotinfo_list has been exhausted, the next call to
_dl_allocate_tls_init (say, when creating the next thread) will fail with:

Inconsistency detected by ld.so: dl-tls.c: 422: _dl_allocate_tls_init:
Assertion `map->l_tls_modid == cnt' failed!

glibc has a few data structures regarding thread-local storage handling. A
segmented array with all loaded shared objects that need TLS
(dl_tls_dtv_slotinfo_list) and a fixed size array (dtv, part of the TCB).

However, glibc has an incorrect assertion if an initial-exec shared object has
been successfully loaded, but is assigned a slot outside of the initial segment
of dl_tls_dtv_slotinfo_list. "cnt" is the index in the current segment, whereas
map->l_tls_modid is the index in the dtv (which includes all segments).

Changing the assertion from

          assert (map->l_tls_modid == cnt);

to

          assert (map->l_tls_modid == total + cnt);

appears to fix the problem, which confirms my hypothesis, but I'm not
well-versed in rtld internals, so there might be something I'm missing here.

I'm attaching a small test program which creates a lot of shared libraries with
initial-exec, dlopen()s them, and then creates a new thread; the call to
_dl_allocate_tls_init from within pthread_create triggers the assertion.

-- 
You are receiving this mail because:
You are on the CC list for the bug.