aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHector Martin <marcan@marcan.st>2023-11-28 15:23:07 +0900
committerSzabolcs Nagy <szabolcs.nagy@arm.com>2023-12-22 14:39:29 +0000
commit5f08ec08d03930050befec16fcc6264fa00c66fe (patch)
tree5f517440b0410db53f80b593da6dc399d58e4b2b
parent01ea8d9dde2e846dd8afe4d82b388796d4ccec6b (diff)
downloadglibc-5f08ec08d03930050befec16fcc6264fa00c66fe.tar
glibc-5f08ec08d03930050befec16fcc6264fa00c66fe.tar.gz
glibc-5f08ec08d03930050befec16fcc6264fa00c66fe.tar.bz2
glibc-5f08ec08d03930050befec16fcc6264fa00c66fe.zip
elf: Fix TLS modid reuse generation assignment (BZ 29039)
_dl_assign_tls_modid() assigns a slotinfo entry for a new module, but does *not* do anything to the generation counter. The first time this happens, the generation is zero and map_generation() returns the current generation to be used during relocation processing. However, if a slotinfo entry is later reused, it will already have a generation assigned. If this generation has fallen behind the current global max generation, then this causes an obsolete generation to be assigned during relocation processing, as map_generation() returns this generation if nonzero. _dl_add_to_slotinfo() eventually resets the generation, but by then it is too late. This causes DTV updates to be skipped, leading to NULL or broken TLS slot pointers and segfaults. Fix this by resetting the generation to zero in _dl_assign_tls_modid(), so it behaves the same as the first time a slot is assigned. _dl_add_to_slotinfo() will still assign the correct static generation later during module load, but relocation processing will no longer use an obsolete generation. Note that slotinfo entry (aka modid) reuse typically happens after a dlclose and only TLS access via dynamic tlsdesc is affected. Because tlsdesc is optimized to use the optional part of static TLS, dynamic tlsdesc can be avoided by increasing the glibc.rtld.optional_static_tls tunable to a large enough value, or by LD_PRELOAD-ing the affected modules. Fixes bug 29039. Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com> (cherry picked from commit 3921c5b40f293c57cb326f58713c924b0662ef59)
-rw-r--r--elf/dl-tls.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/elf/dl-tls.c b/elf/dl-tls.c
index 093cdddb7e..bf0ff0d9e8 100644
--- a/elf/dl-tls.c
+++ b/elf/dl-tls.c
@@ -160,6 +160,7 @@ _dl_assign_tls_modid (struct link_map *l)
{
/* Mark the entry as used, so any dependency see it. */
atomic_store_relaxed (&runp->slotinfo[result - disp].map, l);
+ atomic_store_relaxed (&runp->slotinfo[result - disp].gen, 0);
break;
}