[glibc/nsz/bug19329] elf: Refactor _dl_update_slotinfo to avoid use after free

[glibc/nsz/bug19329] elf: Refactor _dl_update_slotinfo to avoid use after free

[Szabolcs Nagy]

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=35ca471c56a9fa19daba490054b84aed737b03d9

commit 35ca471c56a9fa19daba490054b84aed737b03d9
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Wed Dec 30 21:52:38 2020 +0000

    elf: Refactor _dl_update_slotinfo to avoid use after free
    
    map is not valid to access here because it can be freed by a
    concurrent dlclose, so don't check the modid.
    
    The map == 0 and map != 0 code paths can be shared (avoiding
    the dtv resize in case of map == 0 is just an optimization:
    larger dtv than necessary would be fine too).

Diff:
---
 elf/dl-tls.c | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/elf/dl-tls.c b/elf/dl-tls.c
index 24d00c14ef..f8b32b3ecb 100644
--- a/elf/dl-tls.c
+++ b/elf/dl-tls.c
@@ -743,6 +743,8 @@ _dl_update_slotinfo (unsigned long int req_modid)
 	{
 	  for (size_t cnt = total == 0 ? 1 : 0; cnt < listp->len; ++cnt)
 	    {
+	      size_t modid = total + cnt;
+
 	      size_t gen = listp->slotinfo[cnt].gen;
 
 	      if (gen > new_gen)
@@ -758,25 +760,12 @@ _dl_update_slotinfo (unsigned long int req_modid)
 
 	      /* If there is no map this means the entry is empty.  */
 	      struct link_map *map = listp->slotinfo[cnt].map;
-	      if (map == NULL)
-		{
-		  if (dtv[-1].counter >= total + cnt)
-		    {
-		      /* If this modid was used at some point the memory
-			 might still be allocated.  */
-		      free (dtv[total + cnt].pointer.to_free);
-		      dtv[total + cnt].pointer.val = TLS_DTV_UNALLOCATED;
-		      dtv[total + cnt].pointer.to_free = NULL;
-		    }
-
-		  continue;
-		}
-
 	      /* Check whether the current dtv array is large enough.  */
-	      size_t modid = map->l_tls_modid;
-	      assert (total + cnt == modid);
 	      if (dtv[-1].counter < modid)
 		{
+		  if (map == NULL)
+		    continue;
+
 		  /* Resize the dtv.  */
 		  dtv = _dl_resize_dtv (dtv);

[glibc/nsz/bug19329] elf: Refactor _dl_update_slotinfo to avoid use after free

[Szabolcs Nagy]

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=3ecdb956cbf6d1b46e36311ffe7f491ce186cdbc

commit 3ecdb956cbf6d1b46e36311ffe7f491ce186cdbc
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Wed Dec 30 21:52:38 2020 +0000

    elf: Refactor _dl_update_slotinfo to avoid use after free
    
    map is not valid to access here because it can be freed by a
    concurrent dlclose, so don't check the modid.
    
    The map == 0 and map != 0 code paths can be shared (avoiding
    the dtv resize in case of map == 0 is just an optimization:
    larger dtv than necessary would be fine too).

Diff:
---
 elf/dl-tls.c | 21 +++++----------------
 1 file changed, 5 insertions(+), 16 deletions(-)

diff --git a/elf/dl-tls.c b/elf/dl-tls.c
index 24d00c14ef..f8b32b3ecb 100644
--- a/elf/dl-tls.c
+++ b/elf/dl-tls.c
@@ -743,6 +743,8 @@ _dl_update_slotinfo (unsigned long int req_modid)
 	{
 	  for (size_t cnt = total == 0 ? 1 : 0; cnt < listp->len; ++cnt)
 	    {
+	      size_t modid = total + cnt;
+
 	      size_t gen = listp->slotinfo[cnt].gen;
 
 	      if (gen > new_gen)
@@ -758,25 +760,12 @@ _dl_update_slotinfo (unsigned long int req_modid)
 
 	      /* If there is no map this means the entry is empty.  */
 	      struct link_map *map = listp->slotinfo[cnt].map;
-	      if (map == NULL)
-		{
-		  if (dtv[-1].counter >= total + cnt)
-		    {
-		      /* If this modid was used at some point the memory
-			 might still be allocated.  */
-		      free (dtv[total + cnt].pointer.to_free);
-		      dtv[total + cnt].pointer.val = TLS_DTV_UNALLOCATED;
-		      dtv[total + cnt].pointer.to_free = NULL;
-		    }
-
-		  continue;
-		}
-
 	      /* Check whether the current dtv array is large enough.  */
-	      size_t modid = map->l_tls_modid;
-	      assert (total + cnt == modid);
 	      if (dtv[-1].counter < modid)
 		{
+		  if (map == NULL)
+		    continue;
+
 		  /* Resize the dtv.  */
 		  dtv = _dl_resize_dtv (dtv);