diff --git a/ChangeLog b/ChangeLog
index e3a6bacb1a..b68eab55c5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,14 @@
+2015-05-28  H.J. Lu  <hongjiu.lu@intel.com>
+
+	[BZ #18422]
+	* Makefile ($(objpfx)tst-audit2): Depend on $(libdl).
+	($(objpfx)tst-audit2.out): Also depend on
+	$(objpfx)tst-auditmod9b.so.
+	* elf/tst-audit2.c: Include <dlfcn.h>.
+	(calloc_called): New.
+	(calloc): Allow to be called more than once.
+	(do_test): dllopen/dlclose $ORIGIN/tst-auditmod9b.so.
+
 2015-05-28  Wilco Dijkstra  <wdijkstr@arm.com>
 
 	* sysdeps/ieee754/dbl-64/s_fabs.c: (__fabs): Call __builtin_fabs.
diff --git a/NEWS b/NEWS
index 4aff69d3e5..8e2976e366 100644
--- a/NEWS
+++ b/NEWS
@@ -19,7 +19,7 @@ Version 2.22
   18047, 18049, 18068, 18080, 18093, 18100, 18104, 18110, 18111, 18125,
   18128, 18138, 18185, 18196, 18197, 18206, 18210, 18211, 18217, 18220,
   18221, 18234, 18244, 18247, 18287, 18319, 18333, 18346, 18397, 18409,
-  18410, 18412, 18418, 18434, 18444.
+  18410, 18412, 18418, 18422, 18434, 18444.
 
 * Cache information can be queried via sysconf() function on s390 e.g. with
   _SC_LEVEL1_ICACHE_SIZE as argument.
diff --git a/elf/Makefile b/elf/Makefile
index b06e0a7ed2..dedf3c7f50 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -1034,7 +1034,8 @@ $(objpfx)tst-dlmopen3.out: $(objpfx)tst-dlmopen1mod.so
 $(objpfx)tst-audit1.out: $(objpfx)tst-auditmod1.so
 tst-audit1-ENV = LD_AUDIT=$(objpfx)tst-auditmod1.so
 
-$(objpfx)tst-audit2.out: $(objpfx)tst-auditmod1.so
+$(objpfx)tst-audit2: $(libdl)
+$(objpfx)tst-audit2.out: $(objpfx)tst-auditmod1.so $(objpfx)tst-auditmod9b.so
 # Prevent GCC-5 from translating a malloc/memset pair into calloc
 CFLAGS-tst-audit2.c += -fno-builtin
 tst-audit2-ENV = LD_AUDIT=$(objpfx)tst-auditmod1.so
diff --git a/elf/tst-audit2.c b/elf/tst-audit2.c
index acad1b05cf..1d69cd669e 100644
--- a/elf/tst-audit2.c
+++ b/elf/tst-audit2.c
@@ -3,26 +3,35 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <dlfcn.h>
 
 #define MAGIC1 0xabcdef72
 #define MAGIC2 0xd8675309
 static __thread unsigned int magic[] = { MAGIC1, MAGIC2 };
+static __thread int calloc_called;
 
 #undef calloc
 
 /* This calloc definition will be called by the dynamic linker itself.
-   We test that it has initialized our TLS block by the time it does so.  */
+   We test that interposed calloc is called by the dynamic loader, and
+   that TLS is fully initialized by then.  */
 
 void *
 calloc (size_t n, size_t m)
 {
-  if (magic[0] != MAGIC1 || magic[1] != MAGIC2)
+  if (!calloc_called)
     {
-      printf ("{%x, %x} != {%x, %x}\n", magic[0], magic[1], MAGIC1, MAGIC2);
-      abort ();
+      /* Allow our calloc to be called more than once.  */
+      calloc_called = 1;
+      if (magic[0] != MAGIC1 || magic[1] != MAGIC2)
+	{
+	  printf ("{%x, %x} != {%x, %x}\n",
+		  magic[0], magic[1], MAGIC1, MAGIC2);
+	  abort ();
+	}
+      magic[0] = MAGIC2;
+      magic[1] = MAGIC1;
     }
-  magic[0] = MAGIC2;
-  magic[1] = MAGIC1;
 
   n *= m;
   void *ptr = malloc (n);
@@ -34,6 +43,11 @@ calloc (size_t n, size_t m)
 static int
 do_test (void)
 {
+  /* Make sure that our calloc is called from the dynamic linker at least
+     once.  */
+  void *h = dlopen("$ORIGIN/tst-auditmod9b.so", RTLD_LAZY);
+  if (h != NULL)
+    dlclose (h);
   if (magic[1] != MAGIC1 || magic[0] != MAGIC2)
     {
       printf ("{%x, %x} != {%x, %x}\n", magic[0], magic[1], MAGIC2, MAGIC1);