Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 26 Nov 2015 19:59:46 +0100
From: Szabolcs Nagy <>
Subject: [PATCH] ldso: fix the dtv update logic in __tls_get_new

if two or more threads accessed tls in a dso that was loaded after
the threads were created, then __tls_get_new could do out-of-bound
memory access (leading to segfault).

accidentally byte count was used instead of element count when
the new dtv pointer was computed. (dso->new_dtv is (void**).)

it is rare that the same dso provides dtv for several threads,
the crash was not observed in practice, but possible to trigger.
 src/ldso/dynlink.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index 4648e9a..93e7d67 100644
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -1280,7 +1280,7 @@ void *__tls_get_new(size_t *v)
 	/* Get new DTV space from new DSO if needed */
 	if (v[0] > (size_t)self->dtv[0]) {
 		void **newdtv = p->new_dtv +
-			(v[0]+1)*sizeof(void *)*a_fetch_add(&p->new_dtv_idx,1);
+			(v[0]+1)*a_fetch_add(&p->new_dtv_idx,1);
 		memcpy(newdtv, self->dtv,
 			((size_t)self->dtv[0]+1) * sizeof(void *));
 		newdtv[0] = (void *)v[0];

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.