[Bug libc/31339] New: arm32 loader crash after cleanup in 2.36

["adrian.ratiu at collabora dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=31339

            Bug ID: 31339
           Summary: arm32 loader crash after cleanup in 2.36
           Product: glibc
           Version: unspecified
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: adrian.ratiu at collabora dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Hello,

An ARM32 loader crash was noticed while upgrading glibc in ChromiumOS,
which George, (added to CC), tracked down to this cleanup commit:

https://sourceware.org/git/?p=glibc.git;a=commit;h=49d877a80b29d3002887b084eec6676d9f5fec18

In a nutshell, we believe that commit forgot to remove an unnecessary
"ldr    r4, [sl, r4]" in _dl_start_user which causes programs to crash
because, according to the arm32 ABI, r4 is a caller-saved register, so
using its value after the above cleanup commit doesn't make much sense,
as the commit removed its initialization.

Also the result of this ldr is not used, which is a further indication
this crashing instruction was missed during the cleanup.

George applied the following patch which fixed the crash in CrOS:

diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h
index b857bbc868..dd1a0f6b6e 100644
--- a/sysdeps/arm/dl-machine.h
+++ b/sysdeps/arm/dl-machine.h
@@ -139,7 +139,6 @@ _start:\n\
 _dl_start_user:\n\
        adr     r6, .L_GET_GOT\n\
        add     sl, sl, r6\n\
-       ldr     r4, [sl, r4]\n\
        @ save the entry point in another register\n\
        mov     r6, r0\n\
        @ get the original arg count\n\

Can glibc please also apply this fix?

The original debugging/investigation into this issue is public,
though it requires a google/gmail account:
https://issuetracker.google.com/u/1/issues/322172904

Thank you,
Adrian

-- 
You are receiving this mail because:
You are on the CC list for the bug.