[Bug dynamic-link/17075] New: Incorrect calculation for dynamic R_ARM_TLS_DESC relocations

[Bug dynamic-link/17075] New: Incorrect calculation for dynamic R_ARM_TLS_DESC relocations

[macro@linux-mips.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17075

            Bug ID: 17075
           Summary: Incorrect calculation for dynamic R_ARM_TLS_DESC
                    relocations
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: macro@linux-mips.org
                CC: macro@linux-mips.org
            Target: arm-linux-gnueabi

Created attachment 7649
  --> https://sourceware.org/bugzilla/attachment.cgi?id=7649&action=edit
Thread-Local Storage Descriptors for the ARM platform, Revision 0.3 -
2010-09-28

I've noticed external symbol value calculation made in the dynamic
linker while processing the R_ARM_TLS_DESC reloc in the immediately-bound
case is broken.  To figure out the final value of the symbol the
calculation makes use of the descriptor's argument that in this case is
set to the symbol's table index in the symbol table ORed with 0x80000000
and adds it to the actual value of the symbol resolved by the linker.

 Such calculated value is then used if the static specialisation is
selected and the typical result is a segfault.  This is easily reproduced
by trying any program that has (or whose link-time dependency has)
R_ARM_TLS_DESC relocs against external symbols and running it with
$LD_BIND_NOW set to 1 in the environment.

 Such calculation is plain wrong and in the case of an external symbol
the value of the descriptor's argument provided by the static linker can
be simply discarded as it's only needed by the lazy specialisation to
resolve the symbol (that in this case already has been).

 For example this code:

int __thread foo;

int
getfoo (void)
{
  return foo;
}

if built as a shared library:

$ arm-linux-gnueabi -mtls-dialect=gnu2 -fPIC -o libgetfoo.so libgetfoo.c

and then linked against an executable, e.g.:

int getfoo (void);

int
main (void)
{
  return getfoo ();
}

$ arm-linux-gnueabi -mtls-dialect=gnu2 -o getfoo -L. -lgetfoo getfoo.c

will cause the dynamic linker to crash if the executable is run with
$LD_BIND_NOW set to 1.  It is important to note the value of the
`-mtls-dialect' GCC option whose default setting, either of `gnu' or
`gnu2', may not necessarily be the right one to produce a TLS descriptor.

 As a reference I've attached the most recent version (0.3) of the ARM
TLS descriptor specification, since its original publication site at
codesourcery.com has gone and only an older version (0.2.2) seems
publicly available now.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/17075] Incorrect calculation for dynamic R_ARM_TLS_DESC relocations

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17075

--- Comment #1 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "GNU C Library master sources".

The branch, master has been updated
       via  90e5dd482fc4708d559fbec9740104470ffdb9df (commit)
      from  809fdf0d23ddb683eb60672465d7a39d02ef272b (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=90e5dd482fc4708d559fbec9740104470ffdb9df

commit 90e5dd482fc4708d559fbec9740104470ffdb9df
Author: Maciej W. Rozycki <macro@codesourcery.com>
Date:   Fri Jun 20 20:08:03 2014 +0100

    [BZ #17075] ARM: Fix immediate calculation of R_ARM_TLS_DESC

    This fixes the calculation of R_ARM_TLS_DESC relocations for lazy global
    symbol references, i.e. created with `-z lazy' in effect with the static
    linker, where immediate resolution is requested with LD_BIND_NOW.

-----------------------------------------------------------------------

Summary of changes:
 ChangeLog                              |   28 ++++++++++++++++++++
 NEWS                                   |    2 +-
 sysdeps/arm/Makefile                   |   20 ++++++++++++++
 sysdeps/arm/configure                  |   36 ++++++++++++++++++++++++++
 sysdeps/arm/configure.ac               |   13 +++++++++
 sysdeps/arm/dl-machine.h               |    5 +++-
 sysdeps/arm/tst-armtlsdescextlazy.c    |    1 +
 sysdeps/arm/tst-armtlsdescextlazymod.c |    1 +
 sysdeps/arm/tst-armtlsdescextnow.c     |    1 +
 sysdeps/arm/tst-armtlsdescextnowmod.c  |    1 +
 sysdeps/arm/tst-armtlsdescloc.c        |   28 ++++++++++++++++++++
 sysdeps/arm/tst-armtlsdesclocmod.c     |   44 ++++++++++++++++++++++++++++++++
 12 files changed, 178 insertions(+), 2 deletions(-)
 create mode 100644 sysdeps/arm/tst-armtlsdescextlazy.c
 create mode 100644 sysdeps/arm/tst-armtlsdescextlazymod.c
 create mode 100644 sysdeps/arm/tst-armtlsdescextnow.c
 create mode 100644 sysdeps/arm/tst-armtlsdescextnowmod.c
 create mode 100644 sysdeps/arm/tst-armtlsdescloc.c
 create mode 100644 sysdeps/arm/tst-armtlsdesclocmod.c

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/17075] Incorrect calculation for dynamic R_ARM_TLS_DESC relocations

[macro@linux-mips.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=17075

Maciej W. Rozycki <macro@linux-mips.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from Maciej W. Rozycki <macro@linux-mips.org> ---
Fixed as per the automatically entered commit message.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/17075] Incorrect calculation for dynamic R_ARM_TLS_DESC relocations

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=17075

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.