i#7293 print crash: Increase privload tcb size to fix crashes (#7294)

Increases the private TLS "tcb_size" from 0x970 to 0x1000, which fixes
crashes in glibc code like this with an offset larger than 0x970 on a
call to fprintf by a client on Ubuntu 22:

```
(gdb) bt
    at ./libio/libioP.h:947
<fprintf from client here>

=> 0x00007ffdf70909ff <+15>:	mov    %fs:0x972,%al

_sigfault = {si_addr = 0x7ffdf78a4072

7ffdf78a2000-7ffdf78a4000 rw-p 00000000 00:00 0
7ffdf78a4000-7ffdf78a6000 ---p 00000000 00:00 0
```

This fixes the following tests which failed on Ubuntu 22:
+ client.destructor
+ client.file_io
+ code_api,satisfy_w_xor_x|client.file_io
+ sample.memtrace_simple_repstr
+ sample.memtrace_simple_repstr
+ sample.memtrace_simple
+ sample.memval_simple
+ sample.memval_simple_scattergather
+ sample.instrace_simple
+ sample.callstack
+ sample.memtrace_x86_text
+ sample.instrace_x86_text
+ tool.drcachesim.phys_SUDO
+ tool.drcacheoff.phys_SUDO
+ tool.drcacheoff.phys_nopriv

This fixes a crash in this test, but it still fails due to the internal
isa mode error hit in other Ubuntu22 tests (not yet filed separately:
currently under #7270):
+ tool.drcachesim.phys-threads_SUDO

Issue: #7270, #7293
Fixes #7293

Author: derekbruening

core/unix/loader_linux.c

@@ -1,5 +1,5 @@
 /* *******************************************************************************
- * Copyright (c) 2011-2020 Google, Inc.  All rights reserved.
+ * Copyright (c) 2011-2025 Google, Inc.  All rights reserved.
  * Copyright (c) 2011 Massachusetts Institute of Technology  All rights reserved.
  * *******************************************************************************/
 
@@ -133,9 +133,11 @@ static size_t client_tls_size = 2 * 4096;
  * The "lea -0x900(%rax,%rbx,1),%rbx" instruction computes the thread pointer to
  * install.  The allocator used by the loader has no headers, so we don't have a
  * good way to guess how big this allocation was.  Instead we use this estimate.
+ * For Ubuntu22 glibc 2.38, the size is 0x9c0; we use 0x1000 to cover future
+ * expansion.
  */
 /* On A32, the pthread is put before tcbhead instead tcbhead being part of pthread */
-static size_t tcb_size = IF_X64_ELSE(0x900, 0x490);
+static size_t tcb_size_estimate = IF_X64_ELSE(0x1000, 0x490);
 
 /* thread contol block header type from
  * - sysdeps/x86_64/nptl/tls.h
@@ -440,7 +442,8 @@ privload_tls_init(void *app_tp)
         app_tp);
     dr_tp = heap_mmap(client_tls_alloc_size, MEMPROT_READ | MEMPROT_WRITE,
                       VMM_SPECIAL_MMAP | VMM_PER_THREAD);
-    ASSERT(APP_LIBC_TLS_SIZE + TLS_PRE_TCB_SIZE + tcb_size <= client_tls_alloc_size);
+    ASSERT(APP_LIBC_TLS_SIZE + TLS_PRE_TCB_SIZE + tcb_size_estimate <=
+           client_tls_alloc_size);
 #if defined(AARCHXX) || defined(RISCV64)
     /* GDB reads some pthread members (e.g., pid, tid), so we must make sure
      * the size and member locations match to avoid gdb crash.
@@ -454,7 +457,7 @@ privload_tls_init(void *app_tp)
     dr_tp = dr_tp + TLS_PRE_TCB_SIZE + sizeof(tcb_head_t);
     dr_tcb = (tcb_head_t *)(dr_tp - sizeof(tcb_head_t));
 #else
-    dr_tp = dr_tp + client_tls_alloc_size - tcb_size;
+    dr_tp = dr_tp + client_tls_alloc_size - tcb_size_estimate;
     dr_tcb = (tcb_head_t *)dr_tp;
 #endif
     LOG(GLOBAL, LOG_LOADER, 2, "%s: adjust thread pointer to " PFX "\n", __FUNCTION__,
@@ -465,13 +468,13 @@ privload_tls_init(void *app_tp)
     if (app_tp != NULL &&
         !safe_read_ex(
             app_tp - APP_LIBC_TLS_SIZE - TLS_PRE_TCB_SIZE IF_RISCV64(-sizeof(tcb_head_t)),
-            APP_LIBC_TLS_SIZE + TLS_PRE_TCB_SIZE + tcb_size,
+            APP_LIBC_TLS_SIZE + TLS_PRE_TCB_SIZE + tcb_size_estimate,
             dr_tp - APP_LIBC_TLS_SIZE - TLS_PRE_TCB_SIZE IF_RISCV64(-sizeof(tcb_head_t)),
             &tls_bytes_read)) {
         LOG(GLOBAL, LOG_LOADER, 2,
             "%s: read failed, tcb was 0x%lx bytes "
             "instead of 0x%lx\n",
-            __FUNCTION__, tls_bytes_read - APP_LIBC_TLS_SIZE, tcb_size);
+            __FUNCTION__, tls_bytes_read - APP_LIBC_TLS_SIZE, tcb_size_estimate);
 #if defined(AARCHXX) || defined(RISCV64)
     } else {
         dr_pthread_t *dp =
@@ -485,7 +488,8 @@ privload_tls_init(void *app_tp)
      * + our over-estimate crosses a page boundary (our estimate is for latest
      * libc and is larger than on older libc versions): i#855.
      */
-    ASSERT(tls_info.offset <= client_tls_alloc_size - TLS_PRE_TCB_SIZE - tcb_size);
+    ASSERT(tls_info.offset <=
+           client_tls_alloc_size - TLS_PRE_TCB_SIZE - tcb_size_estimate);
 #ifdef X86
     /* Update two self pointers. */
     dr_tcb->tcb = dr_tcb;
@@ -519,7 +523,7 @@ privload_tls_exit(void *dr_tp)
 #ifdef RISCV64
     dr_tp = dr_tp - TLS_PRE_TCB_SIZE - sizeof(tcb_head_t);
 #else
-    dr_tp = dr_tp + tcb_size - client_tls_alloc_size;
+    dr_tp = dr_tp + tcb_size_estimate - client_tls_alloc_size;
 #endif
     heap_munmap(dr_tp, client_tls_alloc_size, VMM_SPECIAL_MMAP | VMM_PER_THREAD);
 }