548bcb
commit ba33937be210da5d07f7f01709323743f66011ce
548bcb
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
548bcb
Date:   Fri Jun 25 10:54:12 2021 -0300
548bcb
548bcb
    elf: Fix DTV gap reuse logic (BZ #27135)
548bcb
    
548bcb
    This is updated version of the 572bd547d57a (reverted by 40ebfd016ad2)
548bcb
    that fixes the _dl_next_tls_modid issues.
548bcb
    
548bcb
    This issue with 572bd547d57a patch is the DTV entry will be only
548bcb
    update on dl_open_worker() with the update_tls_slotinfo() call after
548bcb
    all dependencies are being processed by _dl_map_object_deps().  However
548bcb
    _dl_map_object_deps() itself might call _dl_next_tls_modid(), and since
548bcb
    the _dl_tls_dtv_slotinfo_list::map is not yet set the entry will be
548bcb
    wrongly reused.
548bcb
    
548bcb
    This patch fixes by renaming the _dl_next_tls_modid() function to
548bcb
    _dl_assign_tls_modid() and by passing the link_map so it can set
548bcb
    the slotinfo value so a subsequente _dl_next_tls_modid() call will
548bcb
    see the entry as allocated.
548bcb
    
548bcb
    The intermediary value is cleared up on remove_slotinfo() for the case
548bcb
    a library fails to load with RTLD_NOW.
548bcb
    
548bcb
    This patch fixes BZ #27135.
548bcb
    
548bcb
    Checked on x86_64-linux-gnu.
548bcb
    
548bcb
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
548bcb
548bcb
Conflicts:
548bcb
	elf/Makefile
548bcb
	  (testing differences; libdl removal upstream)
548bcb
548bcb
diff --git a/elf/Makefile b/elf/Makefile
548bcb
index be40e3761cf91c4a..3e71939d3234c4c3 100644
548bcb
--- a/elf/Makefile
548bcb
+++ b/elf/Makefile
548bcb
@@ -242,6 +242,13 @@ one-hundred = $(foreach x,0 1 2 3 4 5 6 7 8 9, \
548bcb
   0$x 1$x 2$x 3$x 4$x 5$x 6$x 7$x 8$x 9$x)
548bcb
 tst-tls-many-dynamic-modules := \
548bcb
   $(foreach n,$(one-hundred),tst-tls-manydynamic$(n)mod)
548bcb
+tst-tls-many-dynamic-modules-dep-suffixes = 0 1 2 3 4 5 6 7 8 9 10 11 12 13 \
548bcb
+					    14 15 16 17 18 19
548bcb
+tst-tls-many-dynamic-modules-dep = \
548bcb
+  $(foreach n,$(tst-tls-many-dynamic-modules-dep-suffixes),tst-tls-manydynamic$(n)mod-dep)
548bcb
+tst-tls-many-dynamic-modules-dep-bad-suffixes = 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14
548bcb
+tst-tls-many-dynamic-modules-dep-bad = \
548bcb
+  $(foreach n,$(tst-tls-many-dynamic-modules-dep-bad-suffixes),tst-tls-manydynamic$(n)mod-dep-bad)
548bcb
 extra-test-objs += $(tlsmod17a-modules:=.os) $(tlsmod18a-modules:=.os) \
548bcb
 		   tst-tlsalign-vars.o
548bcb
 test-extras += tst-tlsmod17a tst-tlsmod18a tst-tlsalign-vars
548bcb
@@ -314,6 +321,8 @@ modules-names = testobj1 testobj2 testobj3 testobj4 testobj5 testobj6 \
548bcb
 		tst-audit11mod1 tst-audit11mod2 tst-auditmod11 \
548bcb
 		tst-audit12mod1 tst-audit12mod2 tst-audit12mod3 tst-auditmod12 \
548bcb
 		tst-latepthreadmod $(tst-tls-many-dynamic-modules) \
548bcb
+		$(tst-tls-many-dynamic-modules-dep) \
548bcb
+		$(tst-tls-many-dynamic-modules-dep-bad) \
548bcb
 		tst-nodelete-dlclose-dso tst-nodelete-dlclose-plugin \
548bcb
 		tst-main1mod tst-libc_dlvsym-dso tst-absolute-sym-lib \
548bcb
 		tst-absolute-zero-lib tst-big-note-lib \
548bcb
@@ -1832,10 +1841,63 @@ $(objpfx)tst-rtld-help.out: $(objpfx)ld.so
548bcb
 	$(evaluate-test)
548bcb
 
548bcb
 # Reuses tst-tls-many-dynamic-modules
548bcb
+$(patsubst %,$(objpfx)%.os,$(tst-tls-many-dynamic-modules-dep)): \
548bcb
+  $(objpfx)tst-tls-manydynamic%mod-dep.os : tst-tls-manydynamicmod.c
548bcb
+	$(compile-command.c) \
548bcb
+	  -DNAME=tls_global_$* -DSETTER=set_value_$* -DGETTER=get_value_$*
548bcb
+$(patsubst %,$(objpfx)%.os,$(tst-tls-many-dynamic-modules-dep-bad)): \
548bcb
+  $(objpfx)tst-tls-manydynamic%mod-dep-bad.os : tst-tls-manydynamicmod.c
548bcb
+	$(compile-command.c) \
548bcb
+	  -DNAME=tls_global_$* -DSETTER=set_value_$* -DGETTER=get_value_$*
548bcb
 tst-tls20mod-bad.so-no-z-defs = yes
548bcb
+# Single dependency.
548bcb
+$(objpfx)tst-tls-manydynamic0mod-dep.so: $(objpfx)tst-tls-manydynamic1mod-dep.so
548bcb
+# Double dependencies.
548bcb
+$(objpfx)tst-tls-manydynamic2mod-dep.so: $(objpfx)tst-tls-manydynamic3mod-dep.so \
548bcb
+					 $(objpfx)tst-tls-manydynamic4mod-dep.so
548bcb
+# Double dependencies with each dependency depent of another module.
548bcb
+$(objpfx)tst-tls-manydynamic5mod-dep.so: $(objpfx)tst-tls-manydynamic6mod-dep.so \
548bcb
+					 $(objpfx)tst-tls-manydynamic7mod-dep.so
548bcb
+$(objpfx)tst-tls-manydynamic6mod-dep.so: $(objpfx)tst-tls-manydynamic8mod-dep.so
548bcb
+$(objpfx)tst-tls-manydynamic7mod-dep.so: $(objpfx)tst-tls-manydynamic8mod-dep.so
548bcb
+# Long chain with one double dependency in the middle
548bcb
+$(objpfx)tst-tls-manydynamic9mod-dep.so: $(objpfx)tst-tls-manydynamic10mod-dep.so \
548bcb
+					 $(objpfx)tst-tls-manydynamic11mod-dep.so
548bcb
+$(objpfx)tst-tls-manydynamic10mod-dep.so: $(objpfx)tst-tls-manydynamic12mod-dep.so
548bcb
+$(objpfx)tst-tls-manydynamic12mod-dep.so: $(objpfx)tst-tls-manydynamic13mod-dep.so
548bcb
+# Long chain with two double depedencies in the middle
548bcb
+$(objpfx)tst-tls-manydynamic14mod-dep.so: $(objpfx)tst-tls-manydynamic15mod-dep.so
548bcb
+$(objpfx)tst-tls-manydynamic15mod-dep.so: $(objpfx)tst-tls-manydynamic16mod-dep.so \
548bcb
+					  $(objpfx)tst-tls-manydynamic17mod-dep.so
548bcb
+$(objpfx)tst-tls-manydynamic16mod-dep.so: $(objpfx)tst-tls-manydynamic18mod-dep.so \
548bcb
+					  $(objpfx)tst-tls-manydynamic19mod-dep.so
548bcb
+# Same but with an invalid module.
548bcb
+# Single dependency.
548bcb
+$(objpfx)tst-tls-manydynamic0mod-dep-bad.so: $(objpfx)tst-tls20mod-bad.so
548bcb
+# Double dependencies.
548bcb
+$(objpfx)tst-tls-manydynamic1mod-dep-bad.so: $(objpfx)tst-tls-manydynamic2mod-dep-bad.so \
548bcb
+					     $(objpfx)tst-tls20mod-bad.so
548bcb
+# Double dependencies with each dependency depent of another module.
548bcb
+$(objpfx)tst-tls-manydynamic3mod-dep-bad.so: $(objpfx)tst-tls-manydynamic4mod-dep-bad.so \
548bcb
+					     $(objpfx)tst-tls-manydynamic5mod-dep-bad.so
548bcb
+$(objpfx)tst-tls-manydynamic4mod-dep-bad.so: $(objpfx)tst-tls20mod-bad.so
548bcb
+$(objpfx)tst-tls-manydynamic5mod-dep-bad.so: $(objpfx)tst-tls20mod-bad.so
548bcb
+# Long chain with one double dependency in the middle
548bcb
+$(objpfx)tst-tls-manydynamic6mod-dep-bad.so: $(objpfx)tst-tls-manydynamic7mod-dep-bad.so \
548bcb
+					     $(objpfx)tst-tls-manydynamic8mod-dep-bad.so
548bcb
+$(objpfx)tst-tls-manydynamic7mod-dep-bad.so: $(objpfx)tst-tls-manydynamic9mod-dep-bad.so
548bcb
+$(objpfx)tst-tls-manydynamic9mod-dep-bad.so: $(objpfx)tst-tls20mod-bad.so
548bcb
+# Long chain with two double depedencies in the middle
548bcb
+$(objpfx)tst-tls-manydynamic10mod-dep-bad.so: $(objpfx)tst-tls-manydynamic11mod-dep-bad.so
548bcb
+$(objpfx)tst-tls-manydynamic11mod-dep-bad.so: $(objpfx)tst-tls-manydynamic12mod-dep-bad.so \
548bcb
+					      $(objpfx)tst-tls-manydynamic13mod-dep-bad.so
548bcb
+$(objpfx)tst-tls-manydynamic12mod-dep-bad.so: $(objpfx)tst-tls-manydynamic14mod-dep-bad.so \
548bcb
+					      $(objpfx)tst-tls20mod-bad.so
548bcb
 $(objpfx)tst-tls20: $(libdl) $(shared-thread-library)
548bcb
 $(objpfx)tst-tls20.out: $(objpfx)tst-tls20mod-bad.so \
548bcb
-			$(tst-tls-many-dynamic-modules:%=$(objpfx)%.so)
548bcb
+			$(tst-tls-many-dynamic-modules:%=$(objpfx)%.so) \
548bcb
+			$(tst-tls-many-dynamic-modules-dep:%=$(objpfx)%.so) \
548bcb
+			$(tst-tls-many-dynamic-modules-dep-bad:%=$(objpfx)%.so) \
548bcb
 
548bcb
 # Reuses tst-tls-many-dynamic-modules
548bcb
 $(objpfx)tst-tls21: $(libdl) $(shared-thread-library)
548bcb
diff --git a/elf/dl-close.c b/elf/dl-close.c
548bcb
index 7d2dc2272cd643f5..18227fe992029364 100644
548bcb
--- a/elf/dl-close.c
548bcb
+++ b/elf/dl-close.c
548bcb
@@ -77,8 +77,6 @@ remove_slotinfo (size_t idx, struct dtv_slotinfo_list *listp, size_t disp,
548bcb
 	 object that wasn't fully set up.  */
548bcb
       if (__glibc_likely (old_map != NULL))
548bcb
 	{
548bcb
-	  assert (old_map->l_tls_modid == idx);
548bcb
-
548bcb
 	  /* Mark the entry as unused.  These can be read concurrently.  */
548bcb
 	  atomic_store_relaxed (&listp->slotinfo[idx - disp].gen,
548bcb
 				GL(dl_tls_generation) + 1);
548bcb
@@ -88,7 +86,11 @@ remove_slotinfo (size_t idx, struct dtv_slotinfo_list *listp, size_t disp,
548bcb
       /* If this is not the last currently used entry no need to look
548bcb
 	 further.  */
548bcb
       if (idx != GL(dl_tls_max_dtv_idx))
548bcb
-	return true;
548bcb
+	{
548bcb
+	  /* There is an unused dtv entry in the middle.  */
548bcb
+	  GL(dl_tls_dtv_gaps) = true;
548bcb
+	  return true;
548bcb
+	}
548bcb
     }
548bcb
 
548bcb
   while (idx - disp > (disp == 0 ? 1 + GL(dl_tls_static_nelem) : 0))
548bcb
diff --git a/elf/dl-load.c b/elf/dl-load.c
548bcb
index 80fc38041a936c3c..cdb5d4b5b67f1ca1 100644
548bcb
--- a/elf/dl-load.c
548bcb
+++ b/elf/dl-load.c
548bcb
@@ -1419,7 +1419,7 @@ cannot enable executable stack as shared object requires");
548bcb
 	     not set up TLS data structures, so don't use them now.  */
548bcb
 	  || __glibc_likely (GL(dl_tls_dtv_slotinfo_list) != NULL)))
548bcb
     /* Assign the next available module ID.  */
548bcb
-    l->l_tls_modid = _dl_next_tls_modid ();
548bcb
+    _dl_assign_tls_modid (l);
548bcb
 
548bcb
 #ifdef DL_AFTER_LOAD
548bcb
   DL_AFTER_LOAD (l);
548bcb
diff --git a/elf/dl-open.c b/elf/dl-open.c
548bcb
index a67fb3aee40860e1..54727402750f4c0c 100644
548bcb
--- a/elf/dl-open.c
548bcb
+++ b/elf/dl-open.c
548bcb
@@ -896,16 +896,6 @@ no more namespaces available for dlmopen()"));
548bcb
 	 state if relocation failed, for example.  */
548bcb
       if (args.map)
548bcb
 	{
548bcb
-	  /* Maybe some of the modules which were loaded use TLS.
548bcb
-	     Since it will be removed in the following _dl_close call
548bcb
-	     we have to mark the dtv array as having gaps to fill the
548bcb
-	     holes.  This is a pessimistic assumption which won't hurt
548bcb
-	     if not true.  There is no need to do this when we are
548bcb
-	     loading the auditing DSOs since TLS has not yet been set
548bcb
-	     up.  */
548bcb
-	  if ((mode & __RTLD_AUDIT) == 0)
548bcb
-	    GL(dl_tls_dtv_gaps) = true;
548bcb
-
548bcb
 	  _dl_close_worker (args.map, true);
548bcb
 
548bcb
 	  /* All l_nodelete_pending objects should have been deleted
548bcb
diff --git a/elf/dl-tls.c b/elf/dl-tls.c
548bcb
index 801eafad3961573c..8c0f9e972d7a0eac 100644
548bcb
--- a/elf/dl-tls.c
548bcb
+++ b/elf/dl-tls.c
548bcb
@@ -122,8 +122,8 @@ oom (void)
548bcb
 }
548bcb
 
548bcb
 
548bcb
-size_t
548bcb
-_dl_next_tls_modid (void)
548bcb
+void
548bcb
+_dl_assign_tls_modid (struct link_map *l)
548bcb
 {
548bcb
   size_t result;
548bcb
 
548bcb
@@ -153,7 +153,11 @@ _dl_next_tls_modid (void)
548bcb
 	      }
548bcb
 
548bcb
 	    if (result - disp < runp->len)
548bcb
-	      break;
548bcb
+	      {
548bcb
+		/* Mark the entry as used, so any dependency see it.  */
548bcb
+		atomic_store_relaxed (&runp->slotinfo[result - disp].map, l);
548bcb
+		break;
548bcb
+	      }
548bcb
 
548bcb
 	    disp += runp->len;
548bcb
 	  }
548bcb
@@ -180,17 +184,14 @@ _dl_next_tls_modid (void)
548bcb
       atomic_store_relaxed (&GL(dl_tls_max_dtv_idx), result);
548bcb
     }
548bcb
 
548bcb
-  return result;
548bcb
+  l->l_tls_modid = result;
548bcb
 }
548bcb
 
548bcb
 
548bcb
 size_t
548bcb
 _dl_count_modids (void)
548bcb
 {
548bcb
-  /* It is rare that we have gaps; see elf/dl-open.c (_dl_open) where
548bcb
-     we fail to load a module and unload it leaving a gap.  If we don't
548bcb
-     have gaps then the number of modids is the current maximum so
548bcb
-     return that.  */
548bcb
+  /* The count is the max unless dlclose or failed dlopen created gaps.  */
548bcb
   if (__glibc_likely (!GL(dl_tls_dtv_gaps)))
548bcb
     return GL(dl_tls_max_dtv_idx);
548bcb
 
548bcb
diff --git a/elf/rtld.c b/elf/rtld.c
548bcb
index 992f825ba00762a7..118c454a2329573f 100644
548bcb
--- a/elf/rtld.c
548bcb
+++ b/elf/rtld.c
548bcb
@@ -1693,7 +1693,7 @@ ERROR: '%s': cannot process note segment.\n", _dl_argv[0]);
548bcb
   /* Add the dynamic linker to the TLS list if it also uses TLS.  */
548bcb
   if (GL(dl_rtld_map).l_tls_blocksize != 0)
548bcb
     /* Assign a module ID.  Do this before loading any audit modules.  */
548bcb
-    GL(dl_rtld_map).l_tls_modid = _dl_next_tls_modid ();
548bcb
+    _dl_assign_tls_modid (&GL(dl_rtld_map));
548bcb
 
548bcb
   audit_list_add_dynamic_tag (&state.audit_list, main_map, DT_AUDIT);
548bcb
   audit_list_add_dynamic_tag (&state.audit_list, main_map, DT_DEPAUDIT);
548bcb
diff --git a/elf/tst-tls20.c b/elf/tst-tls20.c
548bcb
index 9977ec803208b9c8..d8d04fe574597f35 100644
548bcb
--- a/elf/tst-tls20.c
548bcb
+++ b/elf/tst-tls20.c
548bcb
@@ -16,12 +16,14 @@
548bcb
    License along with the GNU C Library; if not, see
548bcb
    <http://www.gnu.org/licenses/>.  */
548bcb
 
548bcb
+#include <array_length.h>
548bcb
 #include <dlfcn.h>
548bcb
 #include <pthread.h>
548bcb
 #include <stdio.h>
548bcb
 #include <stdlib.h>
548bcb
 #include <support/check.h>
548bcb
 #include <support/support.h>
548bcb
+#include <support/test-driver.h>
548bcb
 #include <support/xdlfcn.h>
548bcb
 #include <support/xthread.h>
548bcb
 
548bcb
@@ -59,28 +61,75 @@ access (int i)
548bcb
   char *buf = xasprintf ("tls_global_%02d", i);
548bcb
   dlerror ();
548bcb
   int *p = dlsym (mod[i], buf);
548bcb
-  printf ("mod[%d]: &tls = %p\n", i, p);
548bcb
+  if (test_verbose)
548bcb
+    printf ("mod[%d]: &tls = %p\n", i, p);
548bcb
   if (p == NULL)
548bcb
     FAIL_EXIT1 ("dlsym failed: %s\n", dlerror ());
548bcb
+  TEST_COMPARE (*p, 0);
548bcb
   ++*p;
548bcb
   free (buf);
548bcb
 }
548bcb
 
548bcb
+static void
548bcb
+access_mod (const char *modname, void *mod, int i)
548bcb
+{
548bcb
+  char *modsym = xasprintf ("tls_global_%d", i);
548bcb
+  dlerror ();
548bcb
+  int *p = dlsym (mod, modsym);
548bcb
+  if (test_verbose)
548bcb
+    printf ("%s: &tls = %p\n", modname, p);
548bcb
+  if (p == NULL)
548bcb
+    FAIL_EXIT1 ("dlsym failed: %s\n", dlerror ());
548bcb
+  TEST_COMPARE (*p, 0);
548bcb
+  ++*p;
548bcb
+  free (modsym);
548bcb
+}
548bcb
+
548bcb
+static void
548bcb
+access_dep (int i)
548bcb
+{
548bcb
+  char *modname = xasprintf ("tst-tls-manydynamic%dmod-dep.so", i);
548bcb
+  void *moddep = xdlopen (modname, RTLD_LAZY);
548bcb
+  access_mod (modname, moddep, i);
548bcb
+  free (modname);
548bcb
+  xdlclose (moddep);
548bcb
+}
548bcb
+
548bcb
+struct start_args
548bcb
+{
548bcb
+  const char *modname;
548bcb
+  void *mod;
548bcb
+  int modi;
548bcb
+  int ndeps;
548bcb
+  const int *deps;
548bcb
+};
548bcb
+
548bcb
 static void *
548bcb
 start (void *a)
548bcb
 {
548bcb
+  struct start_args *args = a;
548bcb
+
548bcb
   for (int i = 0; i < NMOD; i++)
548bcb
     if (mod[i] != NULL)
548bcb
       access (i);
548bcb
+
548bcb
+  if (args != NULL)
548bcb
+    {
548bcb
+      access_mod (args->modname, args->mod, args->modi);
548bcb
+      for (int n = 0; n < args->ndeps; n++)
548bcb
+	access_dep (args->deps[n]);
548bcb
+    }
548bcb
+
548bcb
   return 0;
548bcb
 }
548bcb
 
548bcb
-static int
548bcb
-do_test (void)
548bcb
+/* This test gaps with shared libraries with dynamic TLS that has no
548bcb
+   dependencies.  The DTV gap is set with by trying to load an invalid
548bcb
+   module, the entry should be used on the dlopen.  */
548bcb
+static void
548bcb
+do_test_no_depedency (void)
548bcb
 {
548bcb
-  int i;
548bcb
-
548bcb
-  for (i = 0; i < NMOD; i++)
548bcb
+  for (int i = 0; i < NMOD; i++)
548bcb
     {
548bcb
       load_mod (i);
548bcb
       /* Bump the generation of mod[0] without using new dtv slot.  */
548bcb
@@ -91,8 +140,220 @@ do_test (void)
548bcb
       pthread_t t = xpthread_create (0, start, 0);
548bcb
       xpthread_join (t);
548bcb
     }
548bcb
-  for (i = 0; i < NMOD; i++)
548bcb
+  for (int i = 0; i < NMOD; i++)
548bcb
     unload_mod (i);
548bcb
+}
548bcb
+
548bcb
+/* The following test check DTV gaps handling with shared libraries that has
548bcb
+   dependencies.  It defines 5 different sets:
548bcb
+
548bcb
+   1. Single dependency:
548bcb
+      mod0 -> mod1
548bcb
+   2. Double dependency:
548bcb
+      mod2 -> [mod3,mod4]
548bcb
+   3. Double dependency with each dependency depent of another module:
548bcb
+      mod5 -> [mod6,mod7] -> mod8
548bcb
+   4. Long chain with one double dependency in the middle:
548bcb
+      mod9 -> [mod10, mod11] -> mod12 -> mod13
548bcb
+   5. Long chain with two double depedencies in the middle:
548bcb
+      mod14 -> mod15 -> [mod16, mod17]
548bcb
+      mod15 -> [mod18, mod19]
548bcb
+
548bcb
+   This does not cover all the possible gaps and configuration, but it
548bcb
+   should check if different dynamic shared sets are placed correctly in
548bcb
+   different gaps configurations.  */
548bcb
+
548bcb
+static int
548bcb
+nmodules (uint32_t v)
548bcb
+{
548bcb
+  unsigned int r = 0;
548bcb
+  while (v >>= 1)
548bcb
+    r++;
548bcb
+  return r + 1;
548bcb
+}
548bcb
+
548bcb
+static inline bool
548bcb
+is_mod_set (uint32_t g, uint32_t n)
548bcb
+{
548bcb
+  return (1U << (n - 1)) & g;
548bcb
+}
548bcb
+
548bcb
+static void
548bcb
+print_gap (uint32_t g)
548bcb
+{
548bcb
+  if (!test_verbose)
548bcb
+    return;
548bcb
+  printf ("gap: ");
548bcb
+  int nmods = nmodules (g);
548bcb
+  for (int n = 1; n <= nmods; n++)
548bcb
+    printf ("%c", ((1 << (n - 1)) & g) == 0 ? 'G' : 'M');
548bcb
+  printf ("\n");
548bcb
+}
548bcb
+
548bcb
+static void
548bcb
+do_test_dependency (void)
548bcb
+{
548bcb
+  /* Maps the module and its dependencies, use thread to access the TLS on
548bcb
+     each loaded module.  */
548bcb
+  static const int tlsmanydeps0[] = { 1 };
548bcb
+  static const int tlsmanydeps1[] = { 3, 4 };
548bcb
+  static const int tlsmanydeps2[] = { 6, 7, 8 };
548bcb
+  static const int tlsmanydeps3[] = { 10, 11, 12 };
548bcb
+  static const int tlsmanydeps4[] = { 15, 16, 17, 18, 19 };
548bcb
+  static const struct tlsmanydeps_t
548bcb
+  {
548bcb
+    int modi;
548bcb
+    int ndeps;
548bcb
+    const int *deps;
548bcb
+  } tlsmanydeps[] =
548bcb
+  {
548bcb
+    {  0, array_length (tlsmanydeps0), tlsmanydeps0 },
548bcb
+    {  2, array_length (tlsmanydeps1), tlsmanydeps1 },
548bcb
+    {  5, array_length (tlsmanydeps2), tlsmanydeps2 },
548bcb
+    {  9, array_length (tlsmanydeps3), tlsmanydeps3 },
548bcb
+    { 14, array_length (tlsmanydeps4), tlsmanydeps4 },
548bcb
+  };
548bcb
+
548bcb
+  /* The gap configuration is defined as a bitmap: the bit set represents a
548bcb
+     loaded module prior the tests execution, while a bit unsed is a module
548bcb
+     unloaded.  Not all permtation will show gaps, but it is simpler than
548bcb
+     define each one independently.  */
548bcb
+  for (uint32_t g = 0; g < 64; g++)
548bcb
+    {
548bcb
+      print_gap (g);
548bcb
+      int nmods = nmodules (g);
548bcb
+
548bcb
+      int mods[nmods];
548bcb
+      /* We use '0' as indication for a gap, to avoid the dlclose on iteration
548bcb
+	 cleanup.  */
548bcb
+      for (int n = 1; n <= nmods; n++)
548bcb
+	{
548bcb
+	  load_mod (n);
548bcb
+	   mods[n] = n;
548bcb
+	}
548bcb
+      for (int n = 1; n <= nmods; n++)
548bcb
+	{
548bcb
+	  if (!is_mod_set (g, n))
548bcb
+	    {
548bcb
+	      unload_mod (n);
548bcb
+	      mods[n] = 0;
548bcb
+	    }
548bcb
+	}
548bcb
+
548bcb
+      for (int t = 0; t < array_length (tlsmanydeps); t++)
548bcb
+	{
548bcb
+	  char *moddepname = xasprintf ("tst-tls-manydynamic%dmod-dep.so",
548bcb
+					tlsmanydeps[t].modi);
548bcb
+	  void *moddep = xdlopen (moddepname, RTLD_LAZY);
548bcb
+
548bcb
+	  /* Access TLS in all loaded modules.  */
548bcb
+	  struct start_args args =
548bcb
+	    {
548bcb
+	      moddepname,
548bcb
+	      moddep,
548bcb
+	      tlsmanydeps[t].modi,
548bcb
+	      tlsmanydeps[t].ndeps,
548bcb
+	      tlsmanydeps[t].deps
548bcb
+	    };
548bcb
+	  pthread_t t = xpthread_create (0, start, &args);
548bcb
+	  xpthread_join (t);
548bcb
+
548bcb
+	  free (moddepname);
548bcb
+	  xdlclose (moddep);
548bcb
+	}
548bcb
+
548bcb
+      for (int n = 1; n <= nmods; n++)
548bcb
+	if (mods[n] != 0)
548bcb
+	  unload_mod (n);
548bcb
+    }
548bcb
+}
548bcb
+
548bcb
+/* The following test check DTV gaps handling with shared libraries that has
548bcb
+   invalid dependencies.  It defines 5 different sets:
548bcb
+
548bcb
+   1. Single dependency:
548bcb
+      mod0 -> invalid
548bcb
+   2. Double dependency:
548bcb
+      mod1 -> [mod2,invalid]
548bcb
+   3. Double dependency with each dependency depent of another module:
548bcb
+      mod3 -> [mod4,mod5] -> invalid
548bcb
+   4. Long chain with one double dependency in the middle:
548bcb
+      mod6 -> [mod7, mod8] -> mod12 -> invalid
548bcb
+   5. Long chain with two double depedencies in the middle:
548bcb
+      mod10 -> mod11 -> [mod12, mod13]
548bcb
+      mod12 -> [mod14, invalid]
548bcb
+
548bcb
+   This does not cover all the possible gaps and configuration, but it
548bcb
+   should check if different dynamic shared sets are placed correctly in
548bcb
+   different gaps configurations.  */
548bcb
+
548bcb
+static void
548bcb
+do_test_invalid_dependency (bool bind_now)
548bcb
+{
548bcb
+  static const int tlsmanydeps[] = { 0, 1, 3, 6, 10 };
548bcb
+
548bcb
+  /* The gap configuration is defined as a bitmap: the bit set represents a
548bcb
+     loaded module prior the tests execution, while a bit unsed is a module
548bcb
+     unloaded.  Not all permtation will show gaps, but it is simpler than
548bcb
+     define each one independently.  */
548bcb
+  for (uint32_t g = 0; g < 64; g++)
548bcb
+    {
548bcb
+      print_gap (g);
548bcb
+      int nmods = nmodules (g);
548bcb
+
548bcb
+      int mods[nmods];
548bcb
+      /* We use '0' as indication for a gap, to avoid the dlclose on iteration
548bcb
+	 cleanup.  */
548bcb
+      for (int n = 1; n <= nmods; n++)
548bcb
+	{
548bcb
+	  load_mod (n);
548bcb
+	   mods[n] = n;
548bcb
+	}
548bcb
+      for (int n = 1; n <= nmods; n++)
548bcb
+	{
548bcb
+	  if (!is_mod_set (g, n))
548bcb
+	    {
548bcb
+	      unload_mod (n);
548bcb
+	      mods[n] = 0;
548bcb
+	    }
548bcb
+	}
548bcb
+
548bcb
+      for (int t = 0; t < array_length (tlsmanydeps); t++)
548bcb
+	{
548bcb
+	  char *moddepname = xasprintf ("tst-tls-manydynamic%dmod-dep-bad.so",
548bcb
+					tlsmanydeps[t]);
548bcb
+	  void *moddep;
548bcb
+	  if (bind_now)
548bcb
+	    {
548bcb
+	      moddep = dlopen (moddepname, RTLD_NOW);
548bcb
+	      TEST_VERIFY (moddep == 0);
548bcb
+	    }
548bcb
+	  else
548bcb
+	    moddep = dlopen (moddepname, RTLD_LAZY);
548bcb
+
548bcb
+	  /* Access TLS in all loaded modules.  */
548bcb
+	  pthread_t t = xpthread_create (0, start, NULL);
548bcb
+	  xpthread_join (t);
548bcb
+
548bcb
+	  free (moddepname);
548bcb
+	  if (!bind_now)
548bcb
+	    xdlclose (moddep);
548bcb
+	}
548bcb
+
548bcb
+      for (int n = 1; n <= nmods; n++)
548bcb
+	if (mods[n] != 0)
548bcb
+	  unload_mod (n);
548bcb
+    }
548bcb
+}
548bcb
+
548bcb
+static int
548bcb
+do_test (void)
548bcb
+{
548bcb
+  do_test_no_depedency ();
548bcb
+  do_test_dependency ();
548bcb
+  do_test_invalid_dependency (true);
548bcb
+  do_test_invalid_dependency (false);
548bcb
+
548bcb
   return 0;
548bcb
 }
548bcb
 
548bcb
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
548bcb
index 6cbbaa808a596f77..0138353ccb41c5f1 100644
548bcb
--- a/sysdeps/generic/ldsodefs.h
548bcb
+++ b/sysdeps/generic/ldsodefs.h
548bcb
@@ -1111,8 +1111,8 @@ extern ElfW(Addr) _dl_sysdep_start (void **start_argptr,
548bcb
 extern void _dl_sysdep_start_cleanup (void) attribute_hidden;
548bcb
 
548bcb
 
548bcb
-/* Determine next available module ID.  */
548bcb
-extern size_t _dl_next_tls_modid (void) attribute_hidden;
548bcb
+/* Determine next available module ID and set the L l_tls_modid.  */
548bcb
+extern void _dl_assign_tls_modid (struct link_map *l) attribute_hidden;
548bcb
 
548bcb
 /* Count the modules with TLS segments.  */
548bcb
 extern size_t _dl_count_modids (void) attribute_hidden;