[Bug dynamic-link/29235] New: Some tests crash in ELF_DYNAMIC_DO_RELR on powerpc64le

[Bug dynamic-link/29235] New: Some tests crash in ELF_DYNAMIC_DO_RELR on powerpc64le

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29235

            Bug ID: 29235
           Summary: Some tests crash in ELF_DYNAMIC_DO_RELR on powerpc64le
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: critical
          Priority: P1
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
  Target Milestone: ---
            Target: powerpc64le-*-linux-gnu
             Flags: security-

I cleaned up the macro goo for easier debugging, and we crash on line 169:

153     static __always_inline void
154     elf_dynamic_do_relr (struct link_map *map)
155     {
156         ElfW(Addr) l_addr = (map)->l_addr, *where = 0;                      
157         const ElfW(Relr) *r, *end;                                          
158         if ((map)->l_info[DT_RELR] == NULL)                                 
159           return;
160         r = (const ElfW(Relr) *)D_PTR((map), l_info[DT_RELR]);              
161         end = (const ElfW(Relr) *)((const char *)r +                        
162                                    (map)->l_info[DT_RELRSZ]->d_un.d_val);   
163         for (; r < end; r++)                                                
164           {                                                                 
165             ElfW(Relr) entry = *r;                                          
166             if ((entry & 1) == 0)                                           
167               {                                                             
168                 where = (ElfW(Addr) *)(l_addr + entry);                     
169                 *where++ += l_addr;                                         
170               }                                                             
171             else                                                            
172               {                                                             
173                 for (long int i = 0; (entry >>= 1) != 0; i++)               
174                   if ((entry & 1) != 0)                                     
175                     where[i] += l_addr;                                     
176                 where += CHAR_BIT * sizeof(ElfW(Relr)) - 1;                 
177               }                                                             
178           }                                                                 
179     }

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7f9f028 in elf_dynamic_do_relr (map=0x7ffff7ff1320) at
dynamic-link.h:169
169                 *where++ += l_addr;                                         
(gdb) bt
#0  0x00007ffff7f9f028 in elf_dynamic_do_relr (map=0x7ffff7ff1320) at
dynamic-link.h:169
#1  elf_dynamic_relocate (skip_ifunc=<optimized out>,
consider_profile=<optimized out>, 
    lazy=1, scope=0x7ffff7ff16c0, map=0x7ffff7ff1320) at dynamic-link.h:198
#2  _dl_relocate_object (l=0x7ffff7ff1320, scope=0x7ffff7ff16c0, 
    reloc_mode=<optimized out>, consider_profiling=<optimized out>) at
dl-reloc.c:301
#3  0x00007ffff7fb9380 in dl_main (phdr=<optimized out>, phnum=<optimized out>, 
    user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:2314
#4  0x00007ffff7fb4170 in _dl_sysdep_start (start_argptr=<optimized out>, 
    dl_main=0x7ffff7fb6d60 <dl_main>) at
../sysdeps/unix/sysv/linux/dl-sysdep.c:140
#5  0x00007ffff7fb5c58 in _dl_start_final (arg=arg@entry=0x7fffffffec60, 
    info=info@entry=0x7fffffffe650) at rtld.c:497
#6  0x00007ffff7fb68b8 in _dl_start (arg=0x7fffffffec60) at rtld.c:586
#7  0x00007ffff7fb4f38 in _start ()
   from
/builddir/build/BUILD/glibc-2.35.9000-583-gace9e3edbc/build-ppc64le-redhat-linux/elf/ld.so

(gdb) print where
$1 = (Elf64_Addr *) 0x7ffff7eb5dc8
(gdb) print *where
$2 = 67536

I'm hitting a debugability issue here, but I think this address is in a
read-only segment of the main executable.

I don't know yet if BFD ld produced wrong relocation data.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/29235] Some tests crash in ELF_DYNAMIC_DO_RELR on powerpc64le

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29235

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com,
                   |                            |i at maskray dot me,
                   |                            |tuliom at ascii dot art.br

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/29235] Some tests crash in ELF_DYNAMIC_DO_RELR on powerpc64le

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29235

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
With hard-coded paths in tests, I get:

(gdb) print where
$3 = (Elf64_Addr *) 0x100255db8

which is in this read-only mapping:

100160000-100260000 r--p 00160000 08:03 2153963751                      
/builddir/build/BUILD/glibc-2.35.9000-583-gace9e3edbc/build-2/math/test-tgmath3-fma

0000000000255db8 appears in readelf -rW output, so I don't think ld.so's RELR
implementation is at fault.

It looks like page size issue, and the DT_RELR may be accidental. The system
has 64K pages, but we have for the main executable:

  LOAD           0x160000 0x0000000000160000 0x0000000000160000 0x0f10a4
0x0f10a4 R   0x10000
  LOAD           0x255db0 0x0000000000265db0 0x0000000000265db0 0x06a40c
0x06a988 RW  0x10000
[…]
  GNU_RELRO      0x255db0 0x0000000000265db0 0x0000000000265db0 0x06a250
0x06a250 R   0x1

I'm not sure if this kind of layout is supposed to work with 64K pages. Note
that as discussed elsewhere, ld.so rounds down 0x255db0 to the next multiple of
65,536.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/29235] Some tests crash in ELF_DYNAMIC_DO_RELR on powerpc64le

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=29235

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
(But we apply RELRO only after RELR processing, so that ALIGN_DOWN for the
RELRO start address should not matter here.)

-- 
You are receiving this mail because:
You are on the CC list for the bug.