[Bug dynamic-link/16634] New: Application calling dlopen("./a.out",...) may run into _dl_allocate_tls_init: Assertion `listp != ((void *)0)' failed!

["ppluzhnikov at google dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=16634

            Bug ID: 16634
           Summary: Application calling dlopen("./a.out",...) may run into
                     _dl_allocate_tls_init: Assertion `listp != ((void
                    *)0)' failed!
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: ppluzhnikov at google dot com

Test case:

#include <dlfcn.h>
#include <stdio.h>
#include <pthread.h>

__thread int x;

void *fn(void *p)
{
  return p;
}

int main()
{
  int j;
  pthread_t thr;

  for (j = 0; j < 100; ++j)
    {
      void *p = dlopen("./a.out", RTLD_LAZY);
      printf("%2d: &x = %p\n", j, &x);

      pthread_create(&thr, NULL, fn, NULL);
      pthread_join(thr, NULL);

    }
  return 0;
}

gcc -g t.c -ldl -pthread && ./a.out

 0: &x = 0x7f3cc3ddd73c
 1: &x = 0x7f3cc3ddd73c
 2: &x = 0x7f3cc3ddd73c
...
62: &x = 0x7f3cc3ddd73c
63: &x = 0x7f3cc3ddd73c
Inconsistency detected by ld.so: dl-tls.c: 474: _dl_allocate_tls_init:
Assertion `listp != ((void *)0)' failed!

This has been broken since at least glibc-2.3.6, all the way through current
trunk (ade40b10ff5fa59a318cf55b9d8414b758e8df78).

Note: dlopen() actually fails with  "./a.out: cannot dynamically load
executable", but it does so after incrementing dl_tls_max_dtv_idx.

Once we run out of TLS_SLOTINFO_SURPLUS (62), we crash.

-- 
You are receiving this mail because:
You are on the CC list for the bug.