From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <sourceware-bugzilla@sourceware.org>
Received: by sourceware.org (Postfix, from userid 48)
	id B624A3858425; Mon,  5 Feb 2024 14:38:49 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org B624A3858425
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org;
	s=default; t=1707143929;
	bh=uWk3mj4uS0hEYDSJ4UPekLPl83jzcGz5tXUAHArEOt0=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=OB0Bi5ECEICkqgpuwMXeByYV3jF5B6KoGqC/UU/zHtNNKal63Okvuxni3KaQzuyFX
	 ESJSYkgQIsHEBmeImEf4I7qIzzg82YoPvdmUgtAtI86MkC8HXhVayF30gy8rQpXGS0
	 WlnD2sXQcMNhsmBWFGDvuOO9L5zI/Bg6h6oDQfpk=
From: "adhemerval.zanella at linaro dot org"
 <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sourceware.org
Subject: [Bug libc/31339] arm32 loader crash after cleanup in 2.36
Date: Mon, 05 Feb 2024 14:38:49 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: glibc
X-Bugzilla-Component: libc
X-Bugzilla-Version: unspecified
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: adhemerval.zanella at linaro dot org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at sourceware dot org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-31339-131-Il8FEGA8qb@http.sourceware.org/bugzilla/>
In-Reply-To: <bug-31339-131@http.sourceware.org/bugzilla/>
References: <bug-31339-131@http.sourceware.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <glibc-bugs.sourceware.org>

https://sourceware.org/bugzilla/show_bug.cgi?id=3D31339

--- Comment #1 from Adhemerval Zanella <adhemerval.zanella at linaro dot or=
g> ---
It is indeed a overlook from my patch, previous
49d877a80b29d3002887b084eec6676d9f5fec18 r4 would hold the address of the
_SKIP_ARGS which would have a R_ARM_GOTOFF32 relocation, and this would be =
used
later on _dl_start_user to get the _dl_skip_args value after ld.so
self-relocate itself.

I haven't seen this on my tests because the kernel initializes r4 to 0, so
later the 'ld r4, [sl, r4]' will trigger the read of the _GLOBAL_OFFSET_TAB=
LE_.
But it does trigger invalid memory access if the kernel, or the simulator, =
does
not ensure that r4 is 0 initialized.

I will send a patch to fix it.

--=20
You are receiving this mail because:
You are on the CC list for the bug.=