[NTDLL:LDR] Add Implicit Thread Local Storage Support (reactos#7594)

Before Windows Vista, TLS directories were ignored by Ldr* in any module loaded after process creation, which meant that the TLS index in any delay-loaded module remained 0. This means that when running an application targeting Vista and above and its delay-load modules have TLS directories, the following events can happen:

    One or more delay-load modules claim ThreadLocalStoragePointer idx 0, resulting in data corruption and possible buffer overflows as data intended for one of the immediate-load modules is overwritten.

    None of the immediate-load modules has a TLS directory, so ThreadLocalStoragePointer is not initialized. This means that the program crashes when one of the delay-load modules attempts to access its TLS data.

Adding implicit TLS support improves support for NT 6.x/10 user-mode applications, including all contemporary major web browsers.

JIRA issue: CORE-19413

---------

Co-authored-by: Justin Miller <justin.miller@reactos.org>

Author: win32ss

dll/ntdll/include/ntdllp.h

@@ -29,6 +29,18 @@ typedef struct _LDRP_TLS_DATA
     IMAGE_TLS_DIRECTORY TlsDirectory;
 } LDRP_TLS_DATA, *PLDRP_TLS_DATA;
 
+typedef struct _LDRP_OLD_TLS_VECTOR_ENTRY
+{
+    LIST_ENTRY TlsVectorLinks;
+    PVOID* OldTlsVector;
+} LDRP_OLD_TLS_VECTOR_ENTRY, *PLDRP_OLD_TLS_VECTOR_ENTRY;
+
+typedef struct _LDRP_TEB_LIST_ENTRY
+{
+    LIST_ENTRY TebLinks;
+    PTEB Teb;
+} LDRP_TEB_LIST_ENTRY, *PLDRP_TEB_LIST_ENTRY;
+
 typedef
 NTSTATUS
 (NTAPI* PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION)(
@@ -71,7 +83,7 @@ extern PVOID g_pfnSE_ProcessDying;
 NTSTATUS NTAPI LdrpRunInitializeRoutines(IN PCONTEXT Context OPTIONAL);
 VOID NTAPI LdrpInitializeThread(IN PCONTEXT Context);
 NTSTATUS NTAPI LdrpInitializeTls(VOID);
-NTSTATUS NTAPI LdrpAllocateTls(VOID);
+NTSTATUS NTAPI LdrpAllocateTls(_In_ PTEB Teb);
 VOID NTAPI LdrpFreeTls(VOID);
 VOID NTAPI LdrpCallTlsInitializers(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Reason);
 BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context);

dll/ntdll/ldr/ldrinit.c

@@ -51,6 +51,7 @@ RTL_BITMAP TlsExpansionBitMap;
 RTL_BITMAP FlsBitMap;
 BOOLEAN LdrpImageHasTls;
 LIST_ENTRY LdrpTlsList;
+LIST_ENTRY LdrpActiveTebList;
 ULONG LdrpNumberOfTlsEntries;
 ULONG LdrpNumberOfProcessors;
 PVOID NtDllBase;
@@ -509,6 +510,8 @@ NTAPI
 LdrpInitializeThread(IN PCONTEXT Context)
 {
     PPEB Peb = NtCurrentPeb();
+    PTEB Teb = NtCurrentTeb();
+    PLDRP_TEB_LIST_ENTRY TebEntry;
     PLDR_DATA_TABLE_ENTRY LdrEntry;
     PLIST_ENTRY NextEntry, ListHead;
     RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
@@ -535,7 +538,13 @@ LdrpInitializeThread(IN PCONTEXT Context)
     if (LdrpShutdownInProgress) goto Exit;
 
     /* Allocate TLS */
-    LdrpAllocateTls();
+    LdrpAllocateTls(Teb);
+
+    /* Add thread to active TEB list */
+    ListHead = &LdrpActiveTebList;
+    TebEntry = RtlAllocateHeap(RtlGetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*TebEntry));
+    TebEntry->Teb = NtCurrentTeb();
+    InsertTailList(&LdrpActiveTebList, &TebEntry->TebLinks);
 
     /* Start at the beginning */
     ListHead = &Peb->Ldr->InMemoryOrderModuleList;
@@ -1094,6 +1103,7 @@ LdrShutdownThread(VOID)
 {
     PPEB Peb = NtCurrentPeb();
     PTEB Teb = NtCurrentTeb();
+    PLDRP_TEB_LIST_ENTRY TebEntry;
     PLDR_DATA_TABLE_ENTRY LdrEntry;
     PLIST_ENTRY NextEntry, ListHead;
     RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED ActCtx;
@@ -1112,6 +1122,20 @@ LdrShutdownThread(VOID)
     /* Get the Ldr Lock */
     RtlEnterCriticalSection(&LdrpLoaderLock);
 
+    /* Remove the thread from the active TEB list */
+    ListHead = &LdrpActiveTebList;
+    for (NextEntry = ListHead->Blink;
+         NextEntry != ListHead;
+         NextEntry = NextEntry->Blink)
+    {
+        TebEntry = CONTAINING_RECORD(NextEntry, LDRP_TEB_LIST_ENTRY, TebLinks);
+        if (TebEntry->Teb == Teb)
+        {
+            RemoveEntryList(NextEntry);
+            break;
+        }
+    }
+
     /* Start at the end */
     ListHead = &Peb->Ldr->InInitializationOrderModuleList;
     NextEntry = ListHead->Blink;
@@ -1270,12 +1294,16 @@ LdrpInitializeTls(VOID)
 {
     PLIST_ENTRY NextEntry, ListHead;
     PLDR_DATA_TABLE_ENTRY LdrEntry;
+    PLDRP_TEB_LIST_ENTRY TebEntry;
     PIMAGE_TLS_DIRECTORY TlsDirectory;
     PLDRP_TLS_DATA TlsData;
     ULONG Size;
+    NTSTATUS Status;
+    BOOLEAN AllocateTls = FALSE;
 
     /* Initialize the TLS List */
-    InitializeListHead(&LdrpTlsList);
+    if (!LdrpImageHasTls)
+        InitializeListHead(&LdrpTlsList);
 
     /* Loop all the modules */
     ListHead = &NtCurrentPeb()->Ldr->InLoadOrderModuleList;
@@ -1295,8 +1323,12 @@ LdrpInitializeTls(VOID)
         /* Check if we have a directory */
         if (!TlsDirectory) continue;
 
+        if (LdrEntry->Flags & LDRP_TLS_LOADED)
+            continue;
+
         /* Check if the image has TLS */
         if (!LdrpImageHasTls) LdrpImageHasTls = TRUE;
+        AllocateTls = TRUE;
 
         /* Show debug message */
         if (ShowSnaps)
@@ -1313,6 +1345,7 @@ LdrpInitializeTls(VOID)
         /* Lock the DLL and mark it for TLS Usage */
         LdrEntry->LoadCount = -1;
         LdrEntry->TlsIndex = -1;
+        LdrEntry->Flags |= LDRP_TLS_LOADED;
 
         /* Save the cached TLS data */
         TlsData->TlsDirectory = *TlsDirectory;
@@ -1324,29 +1357,57 @@ LdrpInitializeTls(VOID)
     }
 
     /* Done setting up TLS, allocate entries */
-    return LdrpAllocateTls();
+    if (AllocateTls)
+    {
+        Status = LdrpAllocateTls(NtCurrentTeb());
+        if (Status != STATUS_SUCCESS)
+            return Status;
+
+        ListHead = &LdrpActiveTebList;
+        NextEntry = ListHead->Blink;
+
+        for (NextEntry = ListHead->Blink;
+             NextEntry != ListHead;
+             NextEntry = NextEntry->Blink)
+        {
+            TebEntry = CONTAINING_RECORD(NextEntry, LDRP_TEB_LIST_ENTRY, TebLinks);
+            if (TebEntry->Teb != NtCurrentTeb())
+            {
+                Status = LdrpAllocateTls(TebEntry->Teb);
+                if (Status != STATUS_SUCCESS)
+                    return Status;
+            }
+        }
+	}
+
+    return STATUS_SUCCESS;
 }
 
 NTSTATUS
 NTAPI
-LdrpAllocateTls(VOID)
+LdrpAllocateTls(_In_ PTEB Teb)
 {
-    PTEB Teb = NtCurrentTeb();
     PLIST_ENTRY NextEntry, ListHead;
     PLDRP_TLS_DATA TlsData;
     SIZE_T TlsDataSize;
     PVOID *TlsVector;
+    PVOID *OldTlsVector;
+    PLDRP_OLD_TLS_VECTOR_ENTRY OldTlsVectorEntry;
 
     /* Check if we have any entries */
     if (!LdrpNumberOfTlsEntries)
         return STATUS_SUCCESS;
+    /* Check if there are new entries to add to the vector */
+    if (LdrpNumberOfTlsEntries == Teb->UserReserved.ThreadNumberOfTlsEntries)
+        return STATUS_SUCCESS;
 
     /* Allocate the vector array */
     TlsVector = RtlAllocateHeap(RtlGetProcessHeap(),
-                                    0,
-                                    LdrpNumberOfTlsEntries * sizeof(PVOID));
+                                0,
+                                LdrpNumberOfTlsEntries * sizeof(PVOID));
     if (!TlsVector) return STATUS_NO_MEMORY;
-    Teb->ThreadLocalStoragePointer = TlsVector;
+    /* Grab old TLS vector to retrieve existing values */
+    OldTlsVector = Teb->ThreadLocalStoragePointer;
 
     /* Loop the TLS Array */
     ListHead = &LdrpTlsList;
@@ -1360,32 +1421,74 @@ LdrpAllocateTls(VOID)
         /* Allocate this vector */
         TlsDataSize = TlsData->TlsDirectory.EndAddressOfRawData -
                       TlsData->TlsDirectory.StartAddressOfRawData;
-        TlsVector[TlsData->TlsDirectory.Characteristics] = RtlAllocateHeap(RtlGetProcessHeap(),
-                                                                           0,
-                                                                           TlsDataSize);
-        if (!TlsVector[TlsData->TlsDirectory.Characteristics])
+
+        if (!OldTlsVector || ((TlsData->TlsDirectory.Characteristics + 1) > Teb->UserReserved.ThreadNumberOfTlsEntries))
         {
-            /* Out of memory */
-            return STATUS_NO_MEMORY;
-        }
+            TlsVector[TlsData->TlsDirectory.Characteristics] = RtlAllocateHeap(RtlGetProcessHeap(),
+                                                                               0,
+                                                                               TlsDataSize);
+            if (!TlsVector[TlsData->TlsDirectory.Characteristics])
+            {
+                /* Out of memory */
+                return STATUS_NO_MEMORY;
+            }
 
-        /* Show debug message */
-        if (ShowSnaps)
+            /* Show debug message */
+            if (ShowSnaps)
+            {
+                DPRINT1("LDR: TlsVector %p Index %lu = %p copied from %x to %p\n",
+                        TlsVector,
+                        TlsData->TlsDirectory.Characteristics,
+                        &TlsVector[TlsData->TlsDirectory.Characteristics],
+                        TlsData->TlsDirectory.StartAddressOfRawData,
+                        TlsVector[TlsData->TlsDirectory.Characteristics]);
+            }
+
+            /* Copy the data */
+            RtlCopyMemory(TlsVector[TlsData->TlsDirectory.Characteristics],
+                          (PVOID)TlsData->TlsDirectory.StartAddressOfRawData,
+                          TlsDataSize);
+        }
+        else
         {
-            DPRINT1("LDR: TlsVector %p Index %lu = %p copied from %x to %p\n",
-                    TlsVector,
-                    TlsData->TlsDirectory.Characteristics,
-                    &TlsVector[TlsData->TlsDirectory.Characteristics],
-                    TlsData->TlsDirectory.StartAddressOfRawData,
-                    TlsVector[TlsData->TlsDirectory.Characteristics]);
+            /* Reuse the previous thread-local copy of the TLS data in the new vector. */
+            TlsVector[TlsData->TlsDirectory.Characteristics] = OldTlsVector[TlsData->TlsDirectory.Characteristics];
+            /* Show debug message */
+            if (ShowSnaps)
+            {
+                DPRINT1("LDR: TlsVector %p Index %lu = %p recycled from %x to %p\n",
+                        TlsVector,
+                        TlsData->TlsDirectory.Characteristics,
+                        &OldTlsVector[TlsData->TlsDirectory.Characteristics],
+                        OldTlsVector[TlsData->TlsDirectory.Characteristics],
+                        TlsVector[TlsData->TlsDirectory.Characteristics]);
+            }
         }
-
-        /* Copy the data */
-        RtlCopyMemory(TlsVector[TlsData->TlsDirectory.Characteristics],
-                      (PVOID)TlsData->TlsDirectory.StartAddressOfRawData,
-                      TlsDataSize);
     }
 
+    if (OldTlsVector)
+    {
+        OldTlsVectorEntry = RtlAllocateHeap(RtlGetProcessHeap(), 0,
+                                            sizeof(*OldTlsVectorEntry));
+        if (!OldTlsVectorEntry)
+        {
+            RtlFreeHeap(RtlGetProcessHeap(), 0, TlsVector);
+            return STATUS_NO_MEMORY;
+        }
+        OldTlsVectorEntry->OldTlsVector = OldTlsVector;
+        if (Teb->SystemReserved1.OldTlsVectorList)
+        {
+            InsertTailList((PLIST_ENTRY)Teb->SystemReserved1.OldTlsVectorList,
+                           &OldTlsVectorEntry->TlsVectorLinks);
+        }
+        else
+        {
+            InitializeListHead(&OldTlsVectorEntry->TlsVectorLinks);
+            Teb->SystemReserved1.OldTlsVectorList = OldTlsVectorEntry;
+        }
+    }
+    Teb->ThreadLocalStoragePointer = TlsVector;
+    Teb->UserReserved.ThreadNumberOfTlsEntries = LdrpNumberOfTlsEntries;
     /* Done */
     return STATUS_SUCCESS;
 }
@@ -1396,6 +1499,7 @@ LdrpFreeTls(VOID)
 {
     PLIST_ENTRY ListHead, NextEntry;
     PLDRP_TLS_DATA TlsData;
+    PLDRP_OLD_TLS_VECTOR_ENTRY OldTlsVectorDataEntry;
     PVOID *TlsVector;
     PTEB Teb = NtCurrentTeb();
 
@@ -1424,6 +1528,24 @@ LdrpFreeTls(VOID)
     RtlFreeHeap(RtlGetProcessHeap(),
                 0,
                 TlsVector);
+
+    if (Teb->SystemReserved1.OldTlsVectorList)
+    {
+        /* Loop through it */
+        ListHead = (PLIST_ENTRY)Teb->SystemReserved1.OldTlsVectorList;
+        NextEntry = ListHead->Flink;
+        while (NextEntry != ListHead)
+        {
+            OldTlsVectorDataEntry = CONTAINING_RECORD(NextEntry,
+                                                      LDRP_OLD_TLS_VECTOR_ENTRY,
+                                                      TlsVectorLinks);
+            NextEntry = NextEntry->Flink;
+
+            /* Free each old TLS vector and the entry itself */
+            RtlFreeHeap(RtlGetProcessHeap(), 0, OldTlsVectorDataEntry->OldTlsVector);
+            RtlFreeHeap(RtlGetProcessHeap(), 0, OldTlsVectorDataEntry);
+        }
+    }
 }
 
 NTSTATUS
@@ -2436,6 +2558,9 @@ LdrpInitializeProcess(IN PCONTEXT Context,
     RtlpInitializeKeyedEvent();
     RtlpInitializeThreadPooling();
 
+    /* Initialize Active TEB List */
+    InitializeListHead(&LdrpActiveTebList);
+
     /* Initialize TLS */
     Status = LdrpInitializeTls();
     if (!NT_SUCCESS(Status))

dll/ntdll/ldr/ldrutils.c

@@ -2580,6 +2580,18 @@ LdrpLoadDll(IN BOOLEAN Redirected,
                 }
 
                 /* Run the init routine */
+                Status = LdrpInitializeTls();
+                if (!NT_SUCCESS(Status))
+                {
+                    /* Failed, unload the DLL */
+                    if (ShowSnaps)
+                    {
+                        DbgPrint("LDR: Unloading %wZ because dynamic TLS allocation failed; status = 0x%08lx\n",
+                                 DllName,
+                                 Status);
+                    }
+                    LdrUnloadDll(LdrEntry->DllBase);
+                }
                 Status = LdrpRunInitializeRoutines(NULL);
                 if (!NT_SUCCESS(Status))
                 {

modules/rostests/apitests/ntdll/CMakeLists.txt

@@ -1,7 +1,9 @@
 
+add_subdirectory(implicit_tls)
 add_subdirectory(load_notifications)
 add_subdirectory(empty_dll)
 
+include_directories($<TARGET_FILE_DIR:implicit_tls>)
 include_directories($<TARGET_FILE_DIR:load_notifications>)
 include_directories($<TARGET_FILE_DIR:empty_dll>)
 include_directories(${REACTOS_SOURCE_DIR}/ntoskrnl/include)
@@ -38,6 +40,7 @@ add_dependencies(ntdll_crt_test_lib psdk)
 
 list(APPEND SOURCE
     DllLoadNotification.c
+    implicit_tls.c
     LdrEnumResources.c
     LdrFindResource_U.c
     LdrLoadDll.c
@@ -161,6 +164,7 @@ endif()
 list(APPEND PCH_SKIP_SOURCE
     testlist.c)
 
+add_rc_deps(testdata.rc ${CMAKE_CURRENT_BINARY_DIR}/implicit_tls/implicit_tls.dll)
 add_rc_deps(testdata.rc ${CMAKE_CURRENT_BINARY_DIR}/load_notifications/load_notifications.dll)
 add_rc_deps(testdata.rc ${CMAKE_CURRENT_BINARY_DIR}/empty_dll/empty_dll.dll)
 
@@ -180,7 +184,7 @@ target_link_libraries(ntdll_apitest ntdll_crt_test_lib rtl_test_lib wine uuid ${
 set_module_type(ntdll_apitest win32cui)
 add_importlibs(ntdll_apitest msvcrt advapi32 kernel32 ntdll)
 add_pch(ntdll_apitest precomp.h "${PCH_SKIP_SOURCE}")
-add_dependencies(ntdll_apitest load_notifications empty_dll)
+add_dependencies(ntdll_apitest implicit_tls load_notifications empty_dll)
 
 if(NOT MSVC)
     set_source_files_properties(