picnoir/glibc
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

elf: Refactor _dl_update_slotinfo to avoid use after free

Browse source 
map is not valid to access here because it can be freed by a concurrent
dlclose: during tls access (via __tls_get_addr) _dl_update_slotinfo is
called without holding dlopen locks. So don't check the modid of map.

The map == 0 and map != 0 code paths can be shared (avoiding the dtv
resize in case of map == 0 is just an optimization: larger dtv than
necessary would be fine too).

Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
This commit is contained in:
Szabolcs Nagy 2020-12-30 21:52:38 +00:00
parent c489c35054
commit c0669ae1a6
1 changed files with 5 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
elf/dl-tls.c
View file

@ -743,6 +743,8 @@ _dl_update_slotinfo (unsigned long int req_modid)
{
for (size_t cnt = total == 0 ? 1 : 0; cnt < listp->len; ++cnt)
{
size_t modid = total + cnt;
size_t gen = listp->slotinfo[cnt].gen;
if (gen > new_gen)
@ -758,25 +760,12 @@ _dl_update_slotinfo (unsigned long int req_modid)
/* If there is no map this means the entry is empty. */
struct link_map *map = listp->slotinfo[cnt].map;
if (map == NULL)
{
if (dtv[-1].counter >= total + cnt)
{
/* If this modid was used at some point the memory
might still be allocated. */
free (dtv[total + cnt].pointer.to_free);
dtv[total + cnt].pointer.val = TLS_DTV_UNALLOCATED;
dtv[total + cnt].pointer.to_free = NULL;
}
continue;
}
/* Check whether the current dtv array is large enough. */
size_t modid = map->l_tls_modid;
assert (total + cnt == modid);
if (dtv[-1].counter < modid)
{
if (map == NULL)
continue;
/* Resize the dtv. */
dtv = _dl_resize_dtv (dtv);