[Bug dynamic-link/14341] New: Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[Bug dynamic-link/14341] New: Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[mh-sourceware at glandium dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

             Bug #: 14341
           Summary: Dynamic linker crash when DT_JMPREL and DT_REL{,A} are
                    not contiguous
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: critical
          Priority: P2
         Component: dynamic-link
        AssignedTo: unassigned@sourceware.org
        ReportedBy: mh-sourceware@glandium.org
    Classification: Unclassified


Firefox builds (esr, release, beta and aurora, but not nightly) use a hack to
speed up relative relocations induced i/o, and the hack makes rel{,a}.dyn and
rel{,a}.plt non-contiguous: other sections are in-between.

Commit 96154cd892c614f13f32996ce75df1442641fb5b broke that, and this makes
Firefox builds crash on systems with glibc 2.16 (like archlinux).

AFAIK, nothing in the ELF spec obliges the two sections to be contiguous, so I
think that commit should be reverted.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

Andreas Jaeger <aj at suse dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |carlos_odonell at mentor
                   |                            |dot com

--- Comment #1 from Andreas Jaeger <aj at suse dot de> 2012-07-09 11:12:32 UTC ---
The relevant commit is:

commit 96154cd892c614f13f32996ce75df1442641fb5b
Author: Carlos O'Donell <carlos_odonell@mentor.com>
Date:   Sat Apr 7 09:34:45 2012 -0400

    Simplify _ELF_DYNAMIC_DO_RELOC after combining the old two defs.

        * elf/dynamic-link.h (_ELF_DYNAMIC_DO_RELOC): Simplify
        conditions and remove no longer applicable assertion.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[carlos_odonell at mentor dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

Carlos O'Donell <carlos_odonell at mentor dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |UNCONFIRMED
     Ever Confirmed|1                           |0

--- Comment #2 from Carlos O'Donell <carlos_odonell at mentor dot com> 2012-07-09 16:04:54 UTC ---
Can you please use the recently released 2.16?

Can you please update Version in this issue to reflect the true version you
areusing.

We already knew about this failure and fixed it on April 10th as part of:
http://sourceware.org/bugzilla/show_bug.cgi?id=13967

I may have missed something, but I expected this to be fixed.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[mh-sourceware at glandium dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #3 from Mike Hommey <mh-sourceware at glandium dot org> 2012-07-09 16:13:46 UTC ---
(In reply to comment #2)
> Can you please use the recently released 2.16?
> 
> Can you please update Version in this issue to reflect the true version you
> areusing.
> 
> We already knew about this failure and fixed it on April 10th as part of:
> http://sourceware.org/bugzilla/show_bug.cgi?id=13967
> 
> I may have missed something, but I expected this to be fixed.

I'm using the version that's including that fix, but it still crashes.

The following fixes it (which, in practice, mostly reverts
96154cd892c614f13f32996ce75df1442641fb5b) :
--- glibc-2.16.0/elf/dynamic-link.h    2012-06-30 21:12:34.000000000 +0200
+++ glibc-2.16.0.fixed/elf/dynamic-link.h    2012-07-09 10:35:50.579168312
+0200
@@ -280,7 +280,8 @@
                                           \
     if (ranges[0].start + ranges[0].size == (start + size))              \
       ranges[0].size -= size;                          \
-    if (! ELF_DURING_STARTUP && ((do_lazy) || ranges[0].size == 0))          \
+    if ((! ELF_DURING_STARTUP && ((do_lazy) || ranges[0].size == 0)) ||   \
+            (ranges[0].start + ranges[0].size != start))                  \
       {                                      \
         ranges[1].start = start;                          \
         ranges[1].size = size;                          \

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[carlos_odonell at mentor dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #4 from Carlos O'Donell <carlos_odonell at mentor dot com> 2012-07-09 19:20:55 UTC ---
(In reply to comment #3)
> (In reply to comment #2)
> > Can you please use the recently released 2.16?
> > 
> > Can you please update Version in this issue to reflect the true version you
> > areusing.
> > 
> > We already knew about this failure and fixed it on April 10th as part of:
> > http://sourceware.org/bugzilla/show_bug.cgi?id=13967
> > 
> > I may have missed something, but I expected this to be fixed.
> 
> I'm using the version that's including that fix, but it still crashes.
> 
> The following fixes it (which, in practice, mostly reverts
> 96154cd892c614f13f32996ce75df1442641fb5b) :
> --- glibc-2.16.0/elf/dynamic-link.h    2012-06-30 21:12:34.000000000 +0200
> +++ glibc-2.16.0.fixed/elf/dynamic-link.h    2012-07-09 10:35:50.579168312
> +0200
> @@ -280,7 +280,8 @@
>                                            \
>      if (ranges[0].start + ranges[0].size == (start + size))              \
>        ranges[0].size -= size;                          \
> -    if (! ELF_DURING_STARTUP && ((do_lazy) || ranges[0].size == 0))          \
> +    if ((! ELF_DURING_STARTUP && ((do_lazy) || ranges[0].size == 0)) ||   \
> +            (ranges[0].start + ranges[0].size != start))                  \
>        {                                      \
>          ranges[1].start = start;                          \
>          ranges[1].size = size;                          \

Please attach a copy of the firefox binary, or a testcase binary run through
elfhack that crashes using 2.16. I'd like to see what the layout looks like in
the binary.

We are committed to fixing this, but I want to understand what is different
about your binary.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[carlos_odonell at mentor dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

Carlos O'Donell <carlos_odonell at mentor dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |2.16

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[mh-sourceware at glandium dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #5 from Mike Hommey <mh-sourceware at glandium dot org> 2012-07-10 07:54:59 UTC ---
Essentially, elfhack adds sections between .rela.dyn and .rela.plt. (.rel.dyn
and .rel.plt on x86)
Here is a small testcase:

$ cat > test.c <<EOF
#include <stdio.h>

static int __attribute__((section(".bar"))) bar = 0x12345678;

static const char foo[] = "foo";

int main() {
  printf("%s\n", foo);
  return 0;
}
EOF

$ cat > script <<EOF
SECTIONS
{
   .bar : { *(.bar) }
}
INSERT AFTER .rela.dyn;
EOF

$ gcc -o test test.c -fPIE -Wl,-T,script
$ LD_BIND_NOW=1 ./test
./test: error while loading shared libraries: unexpected reloc type 0x006008a0

(Some of the libraries Firefox opens are dlopened with RTLD_BIND_NOW, which
triggers the crash ; i figured when testing the above testcase)

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[jakub at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

Jakub Jelinek <jakub at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at redhat dot com

--- Comment #6 from Jakub Jelinek <jakub at redhat dot com> 2012-07-10 07:59:15 UTC ---
Then elfhack is buggy and should be fixed.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[mh-sourceware at glandium dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #7 from Mike Hommey <mh-sourceware at glandium dot org> 2012-07-10 08:02:44 UTC ---
(In reply to comment #6)
> Then elfhack is buggy and should be fixed.

As said in the bug description, nothing in the ELF spec (afaik) obliges that
DT_JMPREL and DT_REL{,A} are contiguous. As a matter of fact, the dynamic
linker handles them being separated just fine when not binding at open.

That being said, elfhack was modified to work around the issue. That doesn't
make it less a bug in glibc.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[jakub at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #8 from Jakub Jelinek <jakub at redhat dot com> 2012-07-10 08:16:49 UTC ---
On some architectures relocation sections can be noncontiguous, on others they
must be contiguous.  These details come from mutual agreement between the
linkers and dynamic linkers, tools that modify the binaries should just obey
the rules.  Slowing down the dynamic linker unnecessarily is a bad idea.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[mh-sourceware at glandium dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #9 from Mike Hommey <mh-sourceware at glandium dot org> 2012-07-10 08:27:29 UTC ---
(In reply to comment #8)
> Slowing down the dynamic linker unnecessarily is a bad idea.

Does it make any kind of significant difference in the present case? We're
looking at a couple instructions, once per library.
Moreover, there's a discrepancy between the behaviour with RTLD_BIND_NOW set or
not.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[carlos at systemhalted dot org]

http://sourceware.org/bugzilla/show_bug.cgi?id=14341

Carlos O'Donell <carlos at systemhalted dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|carlos_odonell at mentor    |carlos at systemhalted dot
                   |dot com                     |org

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[mips32r2 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

Petar Jovanovic <mips32r2 at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mips32r2 at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #10 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  fa19d5c48a6b36518ce68412e3bdde6bfa8aa4a6 (commit)
      from  33c898d1607c1b8dac69c76eec289980292ebfc2 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=fa19d5c48a6b36518ce68412e3bdde6bfa8aa4a6

commit fa19d5c48a6b36518ce68412e3bdde6bfa8aa4a6
Author: Petar Jovanovic <petar.jovanovic@rt-rk.com>
Date:   Wed Aug 20 00:50:54 2014 +0200

    Fix dynamic linker issue with bind-now

    Fix the bind-now case when DT_REL and DT_JMPREL sections are separate
    and there is a gap between them.

        [BZ #14341]
        * elf/dynamic-link.h (elf_machine_lazy_rel): Properly handle the
        case when there is a gap between DT_REL and DT_JMPREL sections.
        * sysdeps/x86_64/Makefile (tests): Add tst-split-dynreloc.
        (LDFLAGS-tst-split-dynreloc): New.
        (tst-split-dynreloc-ENV): Likewise.
        * sysdeps/x86_64/tst-split-dynreloc.c: New file.
        * sysdeps/x86_64/tst-split-dynreloc.lds: Likewise.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                             |   11 +++++++++++
 elf/dynamic-link.h                    |   14 ++++++++------
 sysdeps/x86_64/Makefile               |    5 +++++
 sysdeps/x86_64/tst-split-dynreloc.c   |   28 ++++++++++++++++++++++++++++
 sysdeps/x86_64/tst-split-dynreloc.lds |    5 +++++
 5 files changed, 57 insertions(+), 6 deletions(-)
 create mode 100644 sysdeps/x86_64/tst-split-dynreloc.c
 create mode 100644 sysdeps/x86_64/tst-split-dynreloc.lds

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #11 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  9b9d20faf6185f5dcb36cde48ca3c9db866086ee (commit)
      from  fa19d5c48a6b36518ce68412e3bdde6bfa8aa4a6 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=9b9d20faf6185f5dcb36cde48ca3c9db866086ee

commit 9b9d20faf6185f5dcb36cde48ca3c9db866086ee
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Wed Aug 19 06:01:58 2015 -0700

    Add BZ #14341 to NEWS

-----------------------------------------------------------------------

Summary of changes:
 NEWS |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.23

--- Comment #12 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[zacmanken at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

zacmanken at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zacmanken at gmail dot com

--- Comment #14 from zacmanken at gmail dot com ---
So awesome how the community bands together to solve this!

https://www.adelaidebifolddoors.com.au

https://www.sydneybifolddoorpros.com.au

https://goldcoastbifolddoorpros.com.au

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[zacmanken at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #15 from zacmanken at gmail dot com ---
So awesome how the community bands together to solve this!

https://www.adelaidebifolddoors.com.au

https://www.sydneybifolddoorpros.com.au

https://goldcoastbifolddoorpros.com.au

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[zacmanken at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

--- Comment #16 from zacmanken at gmail dot com ---
So awesome how the community bands together to solve this!

https://www.adelaidebifolddoors.com.au

https://www.sydneybifolddoorpros.com.au

https://goldcoastbifolddoorpros.com.au

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/14341] Dynamic linker crash when DT_JMPREL and DT_REL{,A} are not contiguous

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=14341

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg

-- 
You are receiving this mail because:
You are on the CC list for the bug.