commit c0669ae1a629e16b536bf11cdd0865e0dbcf4bee

Author: Szabolcs Nagy <szabolcs.nagy@arm.com>

Date:   Wed Dec 30 21:52:38 2020 +0000

    elf: Refactor _dl_update_slotinfo to avoid use after free

    map is not valid to access here because it can be freed by a concurrent

    dlclose: during tls access (via __tls_get_addr) _dl_update_slotinfo is

    called without holding dlopen locks. So don't check the modid of map.

    The map == 0 and map != 0 code paths can be shared (avoiding the dtv

    resize in case of map == 0 is just an optimization: larger dtv than

    necessary would be fine too).

    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

diff --git a/elf/dl-tls.c b/elf/dl-tls.c

index 9375650a3ab5247d..15ed01d795a8627a 100644

--- a/elf/dl-tls.c

+++ b/elf/dl-tls.c

@@ -743,6 +743,8 @@ _dl_update_slotinfo (unsigned long int req_modid)

 	{

 	  for (size_t cnt = total == 0 ? 1 : 0; cnt < listp->len; ++cnt)

 	    {

+	      size_t modid = total + cnt;

+

 	      size_t gen = listp->slotinfo[cnt].gen;

 	      if (gen > new_gen)

@@ -758,25 +760,12 @@ _dl_update_slotinfo (unsigned long int req_modid)

 	      /* If there is no map this means the entry is empty.  */

 	      struct link_map *map = listp->slotinfo[cnt].map;

-	      if (map == NULL)

-		{

-		  if (dtv[-1].counter >= total + cnt)

-		    {

-		      /* If this modid was used at some point the memory

-			 might still be allocated.  */

-		      free (dtv[total + cnt].pointer.to_free);

-		      dtv[total + cnt].pointer.val = TLS_DTV_UNALLOCATED;

-		      dtv[total + cnt].pointer.to_free = NULL;

-		    }

-

-		  continue;

-		}

-

 	      /* Check whether the current dtv array is large enough.  */

-	      size_t modid = map->l_tls_modid;

-	      assert (total + cnt == modid);

 	      if (dtv[-1].counter < modid)

 		{

+		  if (map == NULL)

+		    continue;

+

 		  /* Resize the dtv.  */

 		  dtv = _dl_resize_dtv (dtv);