public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
@ 2015-08-10 20:12 ` tmsriram at google dot com
2015-08-10 20:13 ` ppluzhnikov at google dot com
` (9 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: tmsriram at google dot com @ 2015-08-10 20:12 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
Sriraman Tallam <tmsriram at google dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |tmsriram at google dot com
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
@ 2015-08-10 20:12 tmsriram at google dot com
2015-08-10 20:12 ` [Bug libc/18801] " tmsriram at google dot com
` (10 more replies)
0 siblings, 11 replies; 12+ messages in thread
From: tmsriram at google dot com @ 2015-08-10 20:12 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
Bug ID: 18801
Summary: PIE binary with STT_GNU_IFUNC symbol and TEXTREL
segfaults on x86_64
Product: glibc
Version: 2.21
Status: NEW
Severity: normal
Priority: P2
Component: libc
Assignee: unassigned at sourceware dot org
Reporter: tmsriram at google dot com
CC: drepper.fsp at gmail dot com, hjl.tools at gmail dot com,
ppluzhnikov at google dot com
Target Milestone: ---
Created attachment 8500
--> https://sourceware.org/bugzilla/attachment.cgi?id=8500&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it.
We have a PIE binary with TEXTREL and a STT_GNU_IFUNC symbol that segfaults at
start-up.
How to reproduce the problem:
zoo.cc
-------
int zoo_1 () {
return 0;
}
extern "C"
void *selector () {
return (void *)&zoo_1;
}
int zoo() __attribute__ ((ifunc ("selector")));
int main() {
return zoo ();
}
$ g++ -mcmodel=large -pie foo.cc
$readelf -Wta ./a.out | grep TEXTREL
0x0000000000000016 (TEXTREL) 0x0
0x000000000000001e (FLAGS) TEXTREL
$ ./a.out
Segmentation Fault
Notes:
* Use mcmodel=large and -pie to create Text relocations.
$ gdb ./a.out
bt
(gdb) bt
#0 0x000055555555476b in selector ()
#1 0x00007ffff7de6638 in _dl_relocate_object () from
/usr/grte/v4/lib64/ld-linux-x86-64.so.2
#2 0x00007ffff7ddc84d in dl_main () from
/usr/grte/v4/lib64/ld-linux-x86-64.so.2
The segfault happens due to this:
if (__glibc_unlikely (l->l_info[DT_TEXTREL] != NULL))
{
.....
if (__mprotect (newp->start, newp->len, PROT_READ|PROT_WRITE) < 0)
{
...
}
The execute permission of the PT_LOAD segment is removed in the process of
marking for write.
The attached patch seems to fix the problem.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
2015-08-10 20:12 ` [Bug libc/18801] " tmsriram at google dot com
@ 2015-08-10 20:13 ` ppluzhnikov at google dot com
2015-08-10 20:21 ` hjl.tools at gmail dot com
` (8 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: ppluzhnikov at google dot com @ 2015-08-10 20:13 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
Paul Pluzhnikov <ppluzhnikov at google dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|unassigned at sourceware dot org |ppluzhnikov at google dot com
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
2015-08-10 20:12 ` [Bug libc/18801] " tmsriram at google dot com
2015-08-10 20:13 ` ppluzhnikov at google dot com
@ 2015-08-10 20:21 ` hjl.tools at gmail dot com
2015-08-11 20:11 ` tmsriram at google dot com
` (7 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: hjl.tools at gmail dot com @ 2015-08-10 20:21 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #0)
> Created attachment 8500 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it.
>
> We have a PIE binary with TEXTREL and a STT_GNU_IFUNC symbol that segfaults
> at start-up.
>
> How to reproduce the problem:
>
> zoo.cc
> -------
> int zoo_1 () {
> return 0;
> }
>
> extern "C"
> void *selector () {
> return (void *)&zoo_1;
> }
>
> int zoo() __attribute__ ((ifunc ("selector")));
>
> int main() {
> return zoo ();
> }
>
> $ g++ -mcmodel=large -pie foo.cc
>
> $readelf -Wta ./a.out | grep TEXTREL
> 0x0000000000000016 (TEXTREL) 0x0
> 0x000000000000001e (FLAGS) TEXTREL
>
> $ ./a.out
> Segmentation Fault
>
> Notes:
> * Use mcmodel=large and -pie to create Text relocations.
Please add the testcase to your patch. Please don't use
__attribute__ ((ifunc ("selector")));
since older compilers don't support it.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (2 preceding siblings ...)
2015-08-10 20:21 ` hjl.tools at gmail dot com
@ 2015-08-11 20:11 ` tmsriram at google dot com
2015-08-11 20:20 ` ppluzhnikov at google dot com
` (6 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: tmsriram at google dot com @ 2015-08-11 20:11 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
Sriraman Tallam <tmsriram at google dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #8500|0 |1
is obsolete| |
--- Comment #2 from Sriraman Tallam <tmsriram at google dot com> ---
Created attachment 8503
--> https://sourceware.org/bugzilla/attachment.cgi?id=8503&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it
Added test case.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (3 preceding siblings ...)
2015-08-11 20:11 ` tmsriram at google dot com
@ 2015-08-11 20:20 ` ppluzhnikov at google dot com
2015-08-11 20:28 ` hjl.tools at gmail dot com
` (5 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: ppluzhnikov at google dot com @ 2015-08-11 20:20 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
--- Comment #3 from Paul Pluzhnikov <ppluzhnikov at google dot com> ---
Google ref: b/20921387
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (4 preceding siblings ...)
2015-08-11 20:20 ` ppluzhnikov at google dot com
@ 2015-08-11 20:28 ` hjl.tools at gmail dot com
2015-08-11 20:43 ` tmsriram at google dot com
` (4 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: hjl.tools at gmail dot com @ 2015-08-11 20:28 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #2)
> Created attachment 8503 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it
>
> Added test case.
diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
index ef70a50..da06361 100644
--- a/sysdeps/x86_64/Makefile
+++ b/sysdeps/x86_64/Makefile
@@ -34,6 +34,12 @@ tests-pie += $(quad-pie-test)
$(objpfx)tst-quad1pie: $(objpfx)tst-quadmod1pie.o
$(objpfx)tst-quad2pie: $(objpfx)tst-quadmod2pie.o
+ifunc-pie-txtrel-test += tst-pie-ifunc-txtrel
+tests += $(ifunc-pie-txtrel-test)
+tests-pie += $(ifunc-pie-txtrel-test)
+
+$(objpfx)tst-pie-ifunc-txtrel: $(objpfx)tst-pie-ifunc-txtrel.o
+
Do we need
$(objpfx)tst-pie-ifunc-txtrel: $(objpfx)tst-pie-ifunc-txtrel.o
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (6 preceding siblings ...)
2015-08-11 20:43 ` tmsriram at google dot com
@ 2015-08-11 20:43 ` tmsriram at google dot com
2015-08-11 20:56 ` hjl.tools at gmail dot com
` (2 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: tmsriram at google dot com @ 2015-08-11 20:43 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
Sriraman Tallam <tmsriram at google dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #8503|0 |1
is obsolete| |
--- Comment #5 from Sriraman Tallam <tmsriram at google dot com> ---
Created attachment 8504
--> https://sourceware.org/bugzilla/attachment.cgi?id=8504&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it
Patch Updated.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (5 preceding siblings ...)
2015-08-11 20:28 ` hjl.tools at gmail dot com
@ 2015-08-11 20:43 ` tmsriram at google dot com
2015-08-11 20:43 ` tmsriram at google dot com
` (3 subsequent siblings)
10 siblings, 0 replies; 12+ messages in thread
From: tmsriram at google dot com @ 2015-08-11 20:43 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
Sriraman Tallam <tmsriram at google dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |iant at google dot com
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (7 preceding siblings ...)
2015-08-11 20:43 ` tmsriram at google dot com
@ 2015-08-11 20:56 ` hjl.tools at gmail dot com
2015-08-11 21:03 ` tmsriram at google dot com
2015-08-11 21:05 ` hjl.tools at gmail dot com
10 siblings, 0 replies; 12+ messages in thread
From: hjl.tools at gmail dot com @ 2015-08-11 20:56 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #5)
> Created attachment 8504 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it
>
> Patch Updated.
main:
+ movabsq $selector, %rax
+ call *%rax
+ movl $0, %eax
Remove this line since foo returns 0.
+ ret
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (8 preceding siblings ...)
2015-08-11 20:56 ` hjl.tools at gmail dot com
@ 2015-08-11 21:03 ` tmsriram at google dot com
2015-08-11 21:05 ` hjl.tools at gmail dot com
10 siblings, 0 replies; 12+ messages in thread
From: tmsriram at google dot com @ 2015-08-11 21:03 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
Sriraman Tallam <tmsriram at google dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #8504|0 |1
is obsolete| |
--- Comment #7 from Sriraman Tallam <tmsriram at google dot com> ---
Created attachment 8505
--> https://sourceware.org/bugzilla/attachment.cgi?id=8505&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it
Patch updated.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
* [Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
` (9 preceding siblings ...)
2015-08-11 21:03 ` tmsriram at google dot com
@ 2015-08-11 21:05 ` hjl.tools at gmail dot com
10 siblings, 0 replies; 12+ messages in thread
From: hjl.tools at gmail dot com @ 2015-08-11 21:05 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=18801
--- Comment #8 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #7)
> Created attachment 8505 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it
>
> Patch updated.
Looks good to me. Please send it to libc-alpha@sourceware.org. Thanks.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2015-08-11 21:05 UTC | newest]
Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-08-10 20:12 [Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64 tmsriram at google dot com
2015-08-10 20:12 ` [Bug libc/18801] " tmsriram at google dot com
2015-08-10 20:13 ` ppluzhnikov at google dot com
2015-08-10 20:21 ` hjl.tools at gmail dot com
2015-08-11 20:11 ` tmsriram at google dot com
2015-08-11 20:20 ` ppluzhnikov at google dot com
2015-08-11 20:28 ` hjl.tools at gmail dot com
2015-08-11 20:43 ` tmsriram at google dot com
2015-08-11 20:43 ` tmsriram at google dot com
2015-08-11 20:56 ` hjl.tools at gmail dot com
2015-08-11 21:03 ` tmsriram at google dot com
2015-08-11 21:05 ` hjl.tools at gmail dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).