From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 84A783858429; Thu, 10 Mar 2022 09:07:21 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 84A783858429 From: "alvinhochun at gmail dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug c++/104862] New: extern thread_local (emutls) code crashes with ASLR on Windows Date: Thu, 10 Mar 2022 09:07:21 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: c++ X-Bugzilla-Version: 11.2.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: alvinhochun at gmail dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Mar 2022 09:07:21 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D104862 Bug ID: 104862 Summary: extern thread_local (emutls) code crashes with ASLR on Windows Product: gcc Version: 11.2.0 Status: UNCONFIRMED Severity: normal Priority: P3 Component: c++ Assignee: unassigned at gcc dot gnu.org Reporter: alvinhochun at gmail dot com CC: martin at martin dot st Target Milestone: --- Test code: /// static_test.cpp #include thread_local int s1; extern thread_local int s2; void dummy(void *a) { // no-op } void __attribute__ ((noinline)) a(int v) { s1 =3D v; dummy(&v); s2 =3D v + 1; } int __attribute__ ((noinline)) b() { return s1 + s2; } int main() { int n; std::cin >> n; a(n); std::cout << b(); return 0; } /// static_obj.cpp thread_local int s2; /// ---------- Compiled with mingw-builds mingw-w64 gcc x86_64-11.2.0-release-posix-seh-rt_v9-rev1 [1]: g++ -Og -g -std=3Dgnu++17 -c static_obj.cpp -o static_obj.o g++ -Og -g -std=3Dgnu++17 static_test.cpp static_obj.o -o static_test.exe Running it segfaults: (gdb) r Starting program: D:\temp\static_test.exe [New Thread 5368.0x4568] [New Thread 5368.0x5598] [New Thread 5368.0x4aec] 1 # <-- user input Thread 1 received signal SIGSEGV, Segmentation fault. 0x00007ff663890000 in ?? () (gdb) disas a Dump of assembler code for function _Z1ai: 0x00007ff6a3891587 <+0>: push %rbx 0x00007ff6a3891588 <+1>: sub $0x20,%rsp 0x00007ff6a389158c <+5>: mov %ecx,%ebx 0x00007ff6a389158e <+7>: lea 0x1a8b(%rip),%rcx # 0x7ff6a3893020 <__emutls_v.s1> 0x00007ff6a3891595 <+14>: call 0x7ff6a3892730 <__emutls_get_address> 0x00007ff6a389159a <+19>: mov %ebx,(%rax) 0x00007ff6a389159c <+21>: add $0x1,%ebx 0x00007ff6a389159f <+24>: lea -0x400015a6(%rip),%rax # 0x7ff663890000 0x00007ff6a38915a6 <+31>: test %rax,%rax 0x00007ff6a38915a9 <+34>: je 0x7ff6a38915b0 <_Z1ai+41> 0x00007ff6a38915ab <+36>: call 0x7ff663890000 0x00007ff6a38915b0 <+41>: mov 0x2d99(%rip),%rcx # 0x7ff6a3894350 <.refptr.__emutls_v.s2> 0x00007ff6a38915b7 <+48>: call 0x7ff6a3892730 <__emutls_get_address> 0x00007ff6a38915bc <+53>: mov %ebx,(%rax) 0x00007ff6a38915be <+55>: add $0x20,%rsp 0x00007ff6a38915c2 <+59>: pop %rbx 0x00007ff6a38915c3 <+60>: ret End of assembler dump. Note the assembler from +24 to +36. The generated assembler (corresponding to +24 ~ +53): leaq _ZTH2s2(%rip), %rax testq %rax, %rax je .L7 call _ZTH2s2 .L7: movq .refptr.__emutls_v.s2(%rip), %rcx call __emutls_get_address movl %ebx, (%rax) It looks like the symbol _ZTH2s2 is the "thread-local initialization routine for s2" (which is declared weak) and ends up being null, which is what `-0x400015a6(%rip)` is supposed to point to. But due to ASLR this address e= nds up being offset and causing the jump to not be taken and then calling an invalid address. Clang uses `cmpq $0, .refptr._ZTH2s2(%rip)` for this which doesn't have the same problem. (Many thanks to Martin Storsj=C3=B6 for helping me on this.) [1]: https://github.com/niXman/mingw-builds-binaries/releases/tag/11.2.0-rt_v9-r= ev1=