Partial backport of:

commit a42faf59d6d9f82e5293a9ebcc26d9c9e562b12b

Author: Paul Pluzhnikov <ppluzhnikov@google.com>

Date:   Mon Mar 24 10:58:26 2014 -0700

    Fix BZ #16634.

    An application that erroneously tries to repeatedly dlopen("a.out", ...)

    may hit assertion failure:

      Inconsistency detected by ld.so: dl-tls.c: 474: _dl_allocate_tls_init:

      Assertion `listp != ((void *)0)' failed!

    dlopen() actually fails with  "./a.out: cannot dynamically load executable",

    but it does so after incrementing dl_tls_max_dtv_idx.

    Once we run out of TLS_SLOTINFO_SURPLUS (62), we exit with above assertion

    failure.

    2014-03-24  Paul Pluzhnikov  <ppluzhnikov@google.com>

            [BZ #16634]

            * elf/dl-load.c (open_verify): Add mode parameter.

            Error early when ET_EXEC and mode does not have __RTLD_OPENEXEC.

            (open_path): Change from boolean 'secure' to complete flag 'mode'

            (_dl_map_object): Adjust.

            * elf/Makefile (tests): Add tst-dlopen-aout.

            * elf/tst-dlopen-aout.c: New test.

Only the change to elf/dl-load.c is included here.  The upstream test

does not work because it depends on --enable-hardcoded-path-in-tests

(which is not available in this tree, despite being documented in the

manual).

diff --git a/elf/dl-load.c b/elf/dl-load.c

index 6a0005da502c8f37..0ba0712aa5201fa0 100644

--- a/elf/dl-load.c

+++ b/elf/dl-load.c

@@ -1686,7 +1686,7 @@ print_search_path (struct r_search_path_elem **list,

    user might want to know about this.  */

 static int

 open_verify (const char *name, struct filebuf *fbp, struct link_map *loader,

-	     int whatcode, bool *found_other_class, bool free_name)

+	     int whatcode, int mode, bool *found_other_class, bool free_name)

 {

   /* This is the expected ELF header.  */

 #define ELF32_CLASS ELFCLASS32

@@ -1863,6 +1863,17 @@ open_verify (const char *name, struct filebuf *fbp, struct link_map *loader,

 	  errstring = N_("only ET_DYN and ET_EXEC can be loaded");

 	  goto call_lose;

 	}

+      else if (__glibc_unlikely (ehdr->e_type == ET_EXEC

+				 && (mode & __RTLD_OPENEXEC) == 0))

+	{

+	  /* BZ #16634. It is an error to dlopen ET_EXEC (unless

+	     __RTLD_OPENEXEC is explicitly set).  We return error here

+	     so that code in _dl_map_object_from_fd does not try to set

+	     l_tls_modid for this module.  */

+

+	  errstring = N_("cannot dynamically load executable");

+	  goto call_lose;

+	}

       else if (__builtin_expect (ehdr->e_phentsize, sizeof (ElfW(Phdr)))

 	       != sizeof (ElfW(Phdr)))

 	{

@@ -1964,7 +1975,7 @@ open_verify (const char *name, struct filebuf *fbp, struct link_map *loader,

    if MAY_FREE_DIRS is true.  */

 static int

-open_path (const char *name, size_t namelen, int secure,

+open_path (const char *name, size_t namelen, int mode,

 	   struct r_search_path_struct *sps, char **realname,

 	   struct filebuf *fbp, struct link_map *loader, int whatcode,

 	   bool *found_other_class)

@@ -2016,8 +2027,8 @@ open_path (const char *name, size_t namelen, int secure,

 	  if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0))

 	    _dl_debug_printf ("  trying file=%s\n", buf);

-	  fd = open_verify (buf, fbp, loader, whatcode, found_other_class,

-			    false);

+	  fd = open_verify (buf, fbp, loader, whatcode, mode,

+			    found_other_class, false);

 	  if (this_dir->status[cnt] == unknown)

 	    {

 	      if (fd != -1)

@@ -2046,7 +2057,7 @@ open_path (const char *name, size_t namelen, int secure,

 	  /* Remember whether we found any existing directory.  */

 	  here_any |= this_dir->status[cnt] != nonexisting;

-	  if (fd != -1 && __builtin_expect (secure, 0)

+	  if (fd != -1 && __builtin_expect (mode & __RTLD_SECURE, 0)

 	      && INTUSE(__libc_enable_secure))

 	    {

 	      /* This is an extra security effort to make sure nobody can

@@ -2236,7 +2247,7 @@ _dl_map_object (struct link_map *loader, const char *name,

 	  for (l = loader; l; l = l->l_loader)

 	    if (cache_rpath (l, &l->l_rpath_dirs, DT_RPATH, "RPATH"))

 	      {

-		fd = open_path (name, namelen, mode & __RTLD_SECURE,

+		fd = open_path (name, namelen, mode,

 				&l->l_rpath_dirs,

 				&realname, &fb, loader, LA_SER_RUNPATH,

 				&found_other_class);

@@ -2252,7 +2263,7 @@ _dl_map_object (struct link_map *loader, const char *name,

 	      && main_map != NULL && main_map->l_type != lt_loaded

 	      && cache_rpath (main_map, &main_map->l_rpath_dirs, DT_RPATH,

 			      "RPATH"))

-	    fd = open_path (name, namelen, mode & __RTLD_SECURE,

+	    fd = open_path (name, namelen, mode,

 			    &main_map->l_rpath_dirs,

 			    &realname, &fb, loader ?: main_map, LA_SER_RUNPATH,

 			    &found_other_class);

@@ -2260,7 +2271,7 @@ _dl_map_object (struct link_map *loader, const char *name,

       /* Try the LD_LIBRARY_PATH environment variable.  */

       if (fd == -1 && env_path_list.dirs != (void *) -1)

-	fd = open_path (name, namelen, mode & __RTLD_SECURE, &env_path_list,

+	fd = open_path (name, namelen, mode, &env_path_list,

 			&realname, &fb,

 			loader ?: GL(dl_ns)[LM_ID_BASE]._ns_loaded,

 			LA_SER_LIBPATH, &found_other_class);

@@ -2269,7 +2280,7 @@ _dl_map_object (struct link_map *loader, const char *name,

       if (fd == -1 && loader != NULL

 	  && cache_rpath (loader, &loader->l_runpath_dirs,

 			  DT_RUNPATH, "RUNPATH"))

-	fd = open_path (name, namelen, mode & __RTLD_SECURE,

+	fd = open_path (name, namelen, mode,

 			&loader->l_runpath_dirs, &realname, &fb, loader,

 			LA_SER_RUNPATH, &found_other_class);

@@ -2326,7 +2337,8 @@ _dl_map_object (struct link_map *loader, const char *name,

 		{

 		  fd = open_verify (cached,

 				    &fb, loader ?: GL(dl_ns)[nsid]._ns_loaded,

-				    LA_SER_CONFIG, &found_other_class, false);

+				    LA_SER_CONFIG, mode, &found_other_class,

+				    false);

 		  if (__builtin_expect (fd != -1, 1))

 		    realname = cached;

 		  else

@@ -2341,7 +2353,7 @@ _dl_map_object (struct link_map *loader, const char *name,

 	  && ((l = loader ?: GL(dl_ns)[nsid]._ns_loaded) == NULL

 	      || __builtin_expect (!(l->l_flags_1 & DF_1_NODEFLIB), 1))

 	  && rtld_search_dirs.dirs != (void *) -1)

-	fd = open_path (name, namelen, mode & __RTLD_SECURE, &rtld_search_dirs,

+	fd = open_path (name, namelen, mode, &rtld_search_dirs,

 			&realname, &fb, l, LA_SER_DEFAULT, &found_other_class);

       /* Add another newline when we are tracing the library loading.  */

@@ -2359,7 +2371,7 @@ _dl_map_object (struct link_map *loader, const char *name,

       else

 	{

 	  fd = open_verify (realname, &fb,

-			    loader ?: GL(dl_ns)[nsid]._ns_loaded, 0,

+			    loader ?: GL(dl_ns)[nsid]._ns_loaded, 0, mode,

 			    &found_other_class, true);

 	  if (__builtin_expect (fd, 0) == -1)

 	    free (realname);