dlfcn: Guard __dlerror_main_freeres with __libc_once_get (once) [BZ#24476]

dlerror.c (__dlerror_main_freeres) will try to free resources which only
have been initialized when init () has been called. That function is
called when resources are needed using __libc_once (once, init) where
once is a __libc_once_define (static, once) in the dlerror.c file.
Trying to free those resources if init () hasn't been called will
produce errors under valgrind memcheck. So guard the freeing of those
resources using __libc_once_get (once) and make sure we have a valid
key. Also add a similar guard to __dlerror ().

	* dlfcn/dlerror.c (__dlerror_main_freeres): Guard using
	__libc_once_get (once) and static_bug == NULL.
	(__dlerror): Check we have a valid key, set result to static_buf
	otherwise.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>
(cherry picked from commit 11b451c8868d8a2b0edc5dfd44fc58d9ee538be0)

diff --git a/ChangeLog b/ChangeLog
index ce563e00eeae4f469b536498f671d00ec92e2c22..934fd6d34143ed955edbf7f234db124282f5c1de 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2019-05-15  Mark Wielaard  <mark@klomp.org>
+
+       [BZ#24476]
+       * dlfcn/dlerror.c (__dlerror_main_freeres): Guard using
+       __libc_once_get (once) and static_buf == NULL.
+       (__dlerror): Check we have a valid key, set result to static_buf
+       otherwise.
+
 2019-05-15  Andreas Schwab  <schwab@suse.de>
 
        [BZ #20568]

diff --git a/NEWS b/NEWS
index 1da958d356c5dac2a0db04b4d84f57295a1799f7..8bad7b0082bfb910ad642aaaddf29c6a41d35744 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -58,6 +58,7 @@ The following bugs are resolved with this release:
   [24097] Can't use 64-bit register for size_t in assembly codes for x32 (CVE-2019-6488)
   [24155] x32 memcmp can treat positive length as 0 (if sign bit in RDX is set) (CVE-2019-7309)
   [24161] __run_fork_handlers self-deadlocks in malloc/tst-mallocfork2
+  [24476] dlfcn: Guard __dlerror_main_freeres with __libc_once_get (once)
 
 Security related changes:
 

diff --git a/dlfcn/dlerror.c b/dlfcn/dlerror.c
index 96bf92533335036b29bdb55c049ef6e50c9cc7a2..06732460ea1512cddd3a2e8b4142fd403e10008b 100644 (file)
--- a/dlfcn/dlerror.c
+++ b/dlfcn/dlerror.c
@@ -72,9 +72,16 @@ __dlerror (void)
   __libc_once (once, init);
 
   /* Get error string.  */
-  result = (struct dl_action_result *) __libc_getspecific (key);
-  if (result == NULL)
-    result = &last_result;
+  if (static_buf != NULL)
+    result = static_buf;
+  else
+    {
+      /* init () has been run and we don't use the static buffer.
+        So we have a valid key.  */
+      result = (struct dl_action_result *) __libc_getspecific (key);
+      if (result == NULL)
+       result = &last_result;
+    }
 
   /* Test whether we already returned the string.  */
   if (result->returned != 0)
@@ -230,13 +237,19 @@ free_key_mem (void *mem)
 void
 __dlerror_main_freeres (void)
 {
-  void *mem;
   /* Free the global memory if used.  */
   check_free (&last_result);
-  /* Free the TSD memory if used.  */
-  mem = __libc_getspecific (key);
-  if (mem != NULL)
-    free_key_mem (mem);
+
+  if (__libc_once_get (once) && static_buf == NULL)
+    {
+      /* init () has been run and we don't use the static buffer.
+        So we have a valid key.  */
+      void *mem;
+      /* Free the TSD memory if used.  */
+      mem = __libc_getspecific (key);
+      if (mem != NULL)
+       free_key_mem (mem);
+    }
 }
 
 struct dlfcn_hook *_dlfcn_hook __attribute__((nocommon));