fix static tls offsets of shared libs on TLS_ABOVE_TP targets

tls_offset should always point to the end of the allocated static tls
area, but this was not handled correctly on "tls variant 1" targets
in the dynamic linker:

after application tls was allocated, tls_offset was aligned up,
potentially wasting tls space. (alignment may be needed at the
begining of the tls area, not at the end, but that will be fixed
separately as it is unlikely to affect real binaries.)

when static tls was allocated for a shared library, tls_offset was
only updated with the size of the tls segment which does not include
alignment gaps, which can easily happen if the tls size update for
one library leaves tls_offset misaligned for the next one. this can
cause oob access in __copy_tls or arbitrary breakage at tls access.
(the issue was observed on aarch64 with rust binaries)

diff --git a/ldso/dynlink.c b/ldso/dynlink.c
index ad0cdba2f44d43b1ccb08d1cb1b7eb84d709d859..967f1fd9342c4cafb98b31ca4a82cfdfbd48ff32 100644 (file)
--- a/ldso/dynlink.c
+++ b/ldso/dynlink.c
@@ -1127,7 +1127,7 @@ static struct dso *load_library(const char *name, struct dso *needed_by)
 #ifdef TLS_ABOVE_TP
                p->tls.offset = tls_offset + ( (tls_align-1) &
                        -(tls_offset + (uintptr_t)p->tls.image) );
-               tls_offset += p->tls.size;
+               tls_offset = p->tls.offset + p->tls.size;
 #else
                tls_offset += p->tls.size + p->tls.align - 1;
                tls_offset -= (tls_offset + (uintptr_t)p->tls.image)
@@ -1797,9 +1797,7 @@ _Noreturn void __dls3(size_t *sp)
 #ifdef TLS_ABOVE_TP
                app.tls.offset = GAP_ABOVE_TP;
                app.tls.offset += -GAP_ABOVE_TP & (app.tls.align-1);
-               tls_offset = app.tls.offset + app.tls.size
-                       + ( -((uintptr_t)app.tls.image + app.tls.size)
-                       & (app.tls.align-1) );
+               tls_offset = app.tls.offset + app.tls.size;
 #else
                tls_offset = app.tls.offset = app.tls.size
                        + ( -((uintptr_t)app.tls.image + app.tls.size)