From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/8931 Path: news.gmane.org!not-for-mail From: Szabolcs Nagy Newsgroups: gmane.linux.lib.musl.general Subject: [PATCH] ldso: fix the dtv update logic in __tls_get_new Date: Thu, 26 Nov 2015 19:59:46 +0100 Message-ID: <20151126185945.GK23362@port70.net> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1448564410 6235 80.91.229.3 (26 Nov 2015 19:00:10 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Thu, 26 Nov 2015 19:00:10 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-8944-gllmg-musl=m.gmane.org@lists.openwall.com Thu Nov 26 20:00:03 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1a21ly-0001Wh-Ph for gllmg-musl@m.gmane.org; Thu, 26 Nov 2015 20:00:03 +0100 Original-Received: (qmail 13512 invoked by uid 550); 26 Nov 2015 19:00:02 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 13479 invoked from network); 26 Nov 2015 18:59:58 -0000 Mail-Followup-To: musl@lists.openwall.com Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) Xref: news.gmane.org gmane.linux.lib.musl.general:8931 Archived-At: if two or more threads accessed tls in a dso that was loaded after the threads were created, then __tls_get_new could do out-of-bound memory access (leading to segfault). accidentally byte count was used instead of element count when the new dtv pointer was computed. (dso->new_dtv is (void**).) it is rare that the same dso provides dtv for several threads, the crash was not observed in practice, but possible to trigger. --- src/ldso/dynlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c index 4648e9a..93e7d67 100644 --- a/src/ldso/dynlink.c +++ b/src/ldso/dynlink.c @@ -1280,7 +1280,7 @@ void *__tls_get_new(size_t *v) /* Get new DTV space from new DSO if needed */ if (v[0] > (size_t)self->dtv[0]) { void **newdtv = p->new_dtv + - (v[0]+1)*sizeof(void *)*a_fetch_add(&p->new_dtv_idx,1); + (v[0]+1)*a_fetch_add(&p->new_dtv_idx,1); memcpy(newdtv, self->dtv, ((size_t)self->dtv[0]+1) * sizeof(void *)); newdtv[0] = (void *)v[0]; -- 2.4.1