[Bug dynamic-link/27136] New: dtv setup at thread creation may leave an entry uninitialized

[Bug dynamic-link/27136] New: dtv setup at thread creation may leave an entry uninitialized

[nsz at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27136

            Bug ID: 27136
           Summary: dtv setup at thread creation may leave an entry
                    uninitialized
           Product: glibc
           Version: 2.32
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: nsz at gcc dot gnu.org
  Target Milestone: ---

dtv setup is supposed to fill in all dtv entries
up to the generation count stored in dtv[0].
otherwise tls access can segfault with null ptr
dereference.

under rare circumstances the last module in the
list may be left uninitialized because of a logic
error in _dl_allocate_tls_init. the fix is

-      if (total >= GL(dl_tls_max_dtv_idx))
+      if (total > GL(dl_tls_max_dtv_idx))
        break;

the max id is a valid index, so it should be
checked and not skipped.

i think the error happens if 64 modules are
loaded with tls and the last one is loaded
as a dependency of the previous module:
mod63 and mod64 have the same tls generation
count but mod64 is on a new slotinfo node.
in that case the generation of the dtv will
be the same as mod64, but dtv[64] will not be
initialized.

if modids are reused (see bug 27135) then
mod64 can have lower generation than mod63
and can be an independently loaded module
so the issue is easier to hit.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/27136] dtv setup at thread creation may leave an entry uninitialized

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27136

--- Comment #1 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d2b997c7172e9a00895a9deb379f8782fbd2e36f

commit d2b997c7172e9a00895a9deb379f8782fbd2e36f
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Wed Dec 30 23:40:14 2020 +0000

    elf: Fix a DTV setup issue [BZ #27136]

    The max modid is a valid index in the dtv, it should not be skipped.

    The bug is observable if the last module has modid == 64 and its
    generation is same or less than the max generation of the previous
    modules.  Then dtv[0].counter implies dtv[64] is initialized but
    it isn't. Fixes bug 27136.

    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/27136] dtv setup at thread creation may leave an entry uninitialized

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27136

--- Comment #2 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8f85075a2e9c26ff7486d4bbaf358999807d215c

commit 8f85075a2e9c26ff7486d4bbaf358999807d215c
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Dec 31 12:24:38 2020 +0000

    elf: Add a DTV setup test [BZ #27136]

    The test dlopens a large number of modules with TLS, they are reused
    from an existing test.

    The test relies on the reuse of slotinfo entries after dlclose, without
    bug 27135 fixed this needs a failing dlopen. With a slotinfo list that
    has non-monotone increasing generation counters, bug 27136 can trigger.

    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/27136] dtv setup at thread creation may leave an entry uninitialized

[nsz at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27136

Szabolcs Nagy <nsz at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.34
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Szabolcs Nagy <nsz at gcc dot gnu.org> ---
fixed for 2.34.

the test cases needed a fix, see commit
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=52290d8c04569615fb011ee286d52dc5147afbd7

-- 
You are receiving this mail because:
You are on the CC list for the bug.