[PATCH] elf: Guard against __LM_ID_CALLER [BZ #27609]

["H.J. Lu" <hjl.tools@gmail.com>]

do_dlopen calls _dl_open with nsid == __LM_ID_CALLER (-2).  When _dl_open
fails in nptl/tst-setuid1 , we can reach

881       /* Avoid keeping around a dangling reference to the libc.so link
882          map in case it has been cached in libc_map.  */
883       if (!args.libc_already_loaded)
884         GL(dl_ns)[nsid].libc_map = NULL;
885

with nsid == -2.  Guard against __LM_ID_CALLER before updating libc_map
to avoid buffer underflow.  This fixes BZ #27609.
---
 elf/dl-open.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/elf/dl-open.c b/elf/dl-open.c
index e90287bc62..5c54df5b7f 100644
--- a/elf/dl-open.c
+++ b/elf/dl-open.c
@@ -885,7 +885,7 @@ no more namespaces available for dlmopen()"));
     {
       /* Avoid keeping around a dangling reference to the libc.so link
 	 map in case it has been cached in libc_map.  */
-      if (!args.libc_already_loaded)
+      if (!args.libc_already_loaded && nsid >= 0)
 	GL(dl_ns)[nsid].libc_map = NULL;
 
       /* Remove the object from memory.  It may be in an inconsistent
-- 
2.31.1