59 lines
1.9 KiB
Diff
59 lines
1.9 KiB
Diff
commit c0669ae1a629e16b536bf11cdd0865e0dbcf4bee
|
|
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
|
|
Date: Wed Dec 30 21:52:38 2020 +0000
|
|
|
|
elf: Refactor _dl_update_slotinfo to avoid use after free
|
|
|
|
map is not valid to access here because it can be freed by a concurrent
|
|
dlclose: during tls access (via __tls_get_addr) _dl_update_slotinfo is
|
|
called without holding dlopen locks. So don't check the modid of map.
|
|
|
|
The map == 0 and map != 0 code paths can be shared (avoiding the dtv
|
|
resize in case of map == 0 is just an optimization: larger dtv than
|
|
necessary would be fine too).
|
|
|
|
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
|
|
|
diff --git a/elf/dl-tls.c b/elf/dl-tls.c
|
|
index 9375650a3ab5247d..15ed01d795a8627a 100644
|
|
--- a/elf/dl-tls.c
|
|
+++ b/elf/dl-tls.c
|
|
@@ -743,6 +743,8 @@ _dl_update_slotinfo (unsigned long int req_modid)
|
|
{
|
|
for (size_t cnt = total == 0 ? 1 : 0; cnt < listp->len; ++cnt)
|
|
{
|
|
+ size_t modid = total + cnt;
|
|
+
|
|
size_t gen = listp->slotinfo[cnt].gen;
|
|
|
|
if (gen > new_gen)
|
|
@@ -758,25 +760,12 @@ _dl_update_slotinfo (unsigned long int req_modid)
|
|
|
|
/* If there is no map this means the entry is empty. */
|
|
struct link_map *map = listp->slotinfo[cnt].map;
|
|
- if (map == NULL)
|
|
- {
|
|
- if (dtv[-1].counter >= total + cnt)
|
|
- {
|
|
- /* If this modid was used at some point the memory
|
|
- might still be allocated. */
|
|
- free (dtv[total + cnt].pointer.to_free);
|
|
- dtv[total + cnt].pointer.val = TLS_DTV_UNALLOCATED;
|
|
- dtv[total + cnt].pointer.to_free = NULL;
|
|
- }
|
|
-
|
|
- continue;
|
|
- }
|
|
-
|
|
/* Check whether the current dtv array is large enough. */
|
|
- size_t modid = map->l_tls_modid;
|
|
- assert (total + cnt == modid);
|
|
if (dtv[-1].counter < modid)
|
|
{
|
|
+ if (map == NULL)
|
|
+ continue;
|
|
+
|
|
/* Resize the dtv. */
|
|
dtv = _dl_resize_dtv (dtv);
|
|
|