* [PATCH] ldso: fix the dtv update logic in __tls_get_new
@ 2015-11-26 18:59 Szabolcs Nagy
0 siblings, 0 replies; only message in thread
From: Szabolcs Nagy @ 2015-11-26 18:59 UTC (permalink / raw)
To: musl
if two or more threads accessed tls in a dso that was loaded after
the threads were created, then __tls_get_new could do out-of-bound
memory access (leading to segfault).
accidentally byte count was used instead of element count when
the new dtv pointer was computed. (dso->new_dtv is (void**).)
it is rare that the same dso provides dtv for several threads,
the crash was not observed in practice, but possible to trigger.
---
src/ldso/dynlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index 4648e9a..93e7d67 100644
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -1280,7 +1280,7 @@ void *__tls_get_new(size_t *v)
/* Get new DTV space from new DSO if needed */
if (v[0] > (size_t)self->dtv[0]) {
void **newdtv = p->new_dtv +
- (v[0]+1)*sizeof(void *)*a_fetch_add(&p->new_dtv_idx,1);
+ (v[0]+1)*a_fetch_add(&p->new_dtv_idx,1);
memcpy(newdtv, self->dtv,
((size_t)self->dtv[0]+1) * sizeof(void *));
newdtv[0] = (void *)v[0];
--
2.4.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2015-11-26 18:59 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-11-26 18:59 [PATCH] ldso: fix the dtv update logic in __tls_get_new Szabolcs Nagy
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).