[Bug libc/31339] New: arm32 loader crash after cleanup in 2.36

[Bug libc/31339] New: arm32 loader crash after cleanup in 2.36

[adrian.ratiu at collabora dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31339

            Bug ID: 31339
           Summary: arm32 loader crash after cleanup in 2.36
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: adrian.ratiu at collabora dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Hello,

An ARM32 loader crash was noticed while upgrading glibc in ChromiumOS,
which George, (added to CC), tracked down to this cleanup commit:

https://sourceware.org/git/?p=glibc.git;a=commit;h=49d877a80b29d3002887b084eec6676d9f5fec18

In a nutshell, we believe that commit forgot to remove an unnecessary
"ldr    r4, [sl, r4]" in _dl_start_user which causes programs to crash
because, according to the arm32 ABI, r4 is a caller-saved register, so
using its value after the above cleanup commit doesn't make much sense,
as the commit removed its initialization.

Also the result of this ldr is not used, which is a further indication
this crashing instruction was missed during the cleanup.

George applied the following patch which fixed the crash in CrOS:

diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h
index b857bbc868..dd1a0f6b6e 100644
--- a/sysdeps/arm/dl-machine.h
+++ b/sysdeps/arm/dl-machine.h
@@ -139,7 +139,6 @@ _start:\n\
 _dl_start_user:\n\
        adr     r6, .L_GET_GOT\n\
        add     sl, sl, r6\n\
-       ldr     r4, [sl, r4]\n\
        @ save the entry point in another register\n\
        mov     r6, r0\n\
        @ get the original arg count\n\

Can glibc please also apply this fix?

The original debugging/investigation into this issue is public,
though it requires a google/gmail account:
https://issuetracker.google.com/u/1/issues/322172904

Thank you,
Adrian

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31339] arm32 loader crash after cleanup in 2.36

[adrian.ratiu at collabora dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31339

Adrian Ratiu <adrian.ratiu at collabora dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |adhemerval.zanella at linaro dot o
                   |                            |rg

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31339] arm32 loader crash after cleanup in 2.36

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31339

--- Comment #1 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
It is indeed a overlook from my patch, previous
49d877a80b29d3002887b084eec6676d9f5fec18 r4 would hold the address of the
_SKIP_ARGS which would have a R_ARM_GOTOFF32 relocation, and this would be used
later on _dl_start_user to get the _dl_skip_args value after ld.so
self-relocate itself.

I haven't seen this on my tests because the kernel initializes r4 to 0, so
later the 'ld r4, [sl, r4]' will trigger the read of the _GLOBAL_OFFSET_TABLE_.
But it does trigger invalid memory access if the kernel, or the simulator, does
not ensure that r4 is 0 initialized.

I will send a patch to fix it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31339] arm32 loader crash after cleanup in 2.36

[adrian.ratiu at collabora dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=31339

--- Comment #2 from Adrian Ratiu <adrian.ratiu at collabora dot com> ---
Thanks again Adhemerval for the prompt response, you are awesome.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/31339] arm32 loader crash after cleanup in 2.36

[adhemerval.zanella at linaro dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31339

Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.40
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #3 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
Fixed on 2.40, I will backport to the affected versions.

-- 
You are receiving this mail because:
You are on the CC list for the bug.