1 files changed, 66 insertions, 0 deletions

diff --git a/meta/recipes-core/glibc/glibc/0030-elf-Refactor_dl_update-slotinfo-to-avoid-use-after-free.patch b/meta/recipes-core/glibc/glibc/0030-elf-Refactor_dl_update-slotinfo-to-avoid-use-after-free.patch
new file mode 100644
index 0000000000..dba491f4dc
--- /dev/null
+++ b/meta/recipes-core/glibc/glibc/0030-elf-Refactor_dl_update-slotinfo-to-avoid-use-after-free.patch
@@ -0,0 +1,66 @@
+From c0669ae1a629e16b536bf11cdd0865e0dbcf4bee Mon Sep 17 00:00:00 2001
+From: Szabolcs Nagy <szabolcs.nagy@arm.com>
+Date: Wed, 30 Dec 2020 21:52:38 +0000
+Subject: [PATCH] elf: Refactor _dl_update_slotinfo to avoid use after free
+
+map is not valid to access here because it can be freed by a concurrent
+dlclose: during tls access (via __tls_get_addr) _dl_update_slotinfo is
+called without holding dlopen locks. So don't check the modid of map.
+
+The map == 0 and map != 0 code paths can be shared (avoiding the dtv
+resize in case of map == 0 is just an optimization: larger dtv than
+necessary would be fine too).
+
+Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+---
+ elf/dl-tls.c | 21 +++++----------------
+ 1 file changed, 5 insertions(+), 16 deletions(-)
+---
+Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=patch;h=c0669ae1a629e16b536bf11cdd0865e0dbcf4bee]
+Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
+Signed-off-by: Akash Hadke <hadkeakash4@gmail.com>
+---
+diff --git a/elf/dl-tls.c b/elf/dl-tls.c
+index 24d00c14ef..f8b32b3ecb 100644
+--- a/elf/dl-tls.c
++++ b/elf/dl-tls.c
+@@ -743,6 +743,8 @@ _dl_update_slotinfo (unsigned long int req_modid)
+        {
+          for (size_t cnt = total == 0 ? 1 : 0; cnt < listp->len; ++cnt)
+            {
++             size_t modid = total + cnt;
++
+              size_t gen = listp->slotinfo[cnt].gen;
+ 
+              if (gen > new_gen)
+@@ -758,25 +760,12 @@ _dl_update_slotinfo (unsigned long int req_modid)
+ 
+              /* If there is no map this means the entry is empty.  */
+              struct link_map *map = listp->slotinfo[cnt].map;
+-             if (map == NULL)
+-               {
+-                 if (dtv[-1].counter >= total + cnt)
+-                   {
+-                     /* If this modid was used at some point the memory
+-                        might still be allocated.  */
+-                     free (dtv[total + cnt].pointer.to_free);
+-                     dtv[total + cnt].pointer.val = TLS_DTV_UNALLOCATED;
+-                     dtv[total + cnt].pointer.to_free = NULL;
+-                   }
+-
+-                 continue;
+-               }
+-
+              /* Check whether the current dtv array is large enough.  */
+-             size_t modid = map->l_tls_modid;
+-             assert (total + cnt == modid);
+              if (dtv[-1].counter < modid)
+                {
++                 if (map == NULL)
++                   continue;
++
+                  /* Resize the dtv.  */
+                  dtv = _dl_resize_dtv (dtv);
+ 
+-- 
+2.27.0