public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/31339] New: arm32 loader crash after cleanup in 2.36
@ 2024-02-05 11:44 adrian.ratiu at collabora dot com
2024-02-05 11:48 ` [Bug libc/31339] " adrian.ratiu at collabora dot com
` (3 more replies)
0 siblings, 4 replies; 5+ messages in thread
From: adrian.ratiu at collabora dot com @ 2024-02-05 11:44 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31339
Bug ID: 31339
Summary: arm32 loader crash after cleanup in 2.36
Product: glibc
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: libc
Assignee: unassigned at sourceware dot org
Reporter: adrian.ratiu at collabora dot com
CC: drepper.fsp at gmail dot com
Target Milestone: ---
Hello,
An ARM32 loader crash was noticed while upgrading glibc in ChromiumOS,
which George, (added to CC), tracked down to this cleanup commit:
https://sourceware.org/git/?p=glibc.git;a=commit;h=49d877a80b29d3002887b084eec6676d9f5fec18
In a nutshell, we believe that commit forgot to remove an unnecessary
"ldr r4, [sl, r4]" in _dl_start_user which causes programs to crash
because, according to the arm32 ABI, r4 is a caller-saved register, so
using its value after the above cleanup commit doesn't make much sense,
as the commit removed its initialization.
Also the result of this ldr is not used, which is a further indication
this crashing instruction was missed during the cleanup.
George applied the following patch which fixed the crash in CrOS:
diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h
index b857bbc868..dd1a0f6b6e 100644
--- a/sysdeps/arm/dl-machine.h
+++ b/sysdeps/arm/dl-machine.h
@@ -139,7 +139,6 @@ _start:\n\
_dl_start_user:\n\
adr r6, .L_GET_GOT\n\
add sl, sl, r6\n\
- ldr r4, [sl, r4]\n\
@ save the entry point in another register\n\
mov r6, r0\n\
@ get the original arg count\n\
Can glibc please also apply this fix?
The original debugging/investigation into this issue is public,
though it requires a google/gmail account:
https://issuetracker.google.com/u/1/issues/322172904
Thank you,
Adrian
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug libc/31339] arm32 loader crash after cleanup in 2.36
2024-02-05 11:44 [Bug libc/31339] New: arm32 loader crash after cleanup in 2.36 adrian.ratiu at collabora dot com
@ 2024-02-05 11:48 ` adrian.ratiu at collabora dot com
2024-02-05 14:38 ` adhemerval.zanella at linaro dot org
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: adrian.ratiu at collabora dot com @ 2024-02-05 11:48 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31339
Adrian Ratiu <adrian.ratiu at collabora dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |adhemerval.zanella at linaro dot o
| |rg
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug libc/31339] arm32 loader crash after cleanup in 2.36
2024-02-05 11:44 [Bug libc/31339] New: arm32 loader crash after cleanup in 2.36 adrian.ratiu at collabora dot com
2024-02-05 11:48 ` [Bug libc/31339] " adrian.ratiu at collabora dot com
@ 2024-02-05 14:38 ` adhemerval.zanella at linaro dot org
2024-02-05 15:57 ` adrian.ratiu at collabora dot com
2024-02-05 18:44 ` adhemerval.zanella at linaro dot org
3 siblings, 0 replies; 5+ messages in thread
From: adhemerval.zanella at linaro dot org @ 2024-02-05 14:38 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31339
--- Comment #1 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
It is indeed a overlook from my patch, previous
49d877a80b29d3002887b084eec6676d9f5fec18 r4 would hold the address of the
_SKIP_ARGS which would have a R_ARM_GOTOFF32 relocation, and this would be used
later on _dl_start_user to get the _dl_skip_args value after ld.so
self-relocate itself.
I haven't seen this on my tests because the kernel initializes r4 to 0, so
later the 'ld r4, [sl, r4]' will trigger the read of the _GLOBAL_OFFSET_TABLE_.
But it does trigger invalid memory access if the kernel, or the simulator, does
not ensure that r4 is 0 initialized.
I will send a patch to fix it.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug libc/31339] arm32 loader crash after cleanup in 2.36
2024-02-05 11:44 [Bug libc/31339] New: arm32 loader crash after cleanup in 2.36 adrian.ratiu at collabora dot com
2024-02-05 11:48 ` [Bug libc/31339] " adrian.ratiu at collabora dot com
2024-02-05 14:38 ` adhemerval.zanella at linaro dot org
@ 2024-02-05 15:57 ` adrian.ratiu at collabora dot com
2024-02-05 18:44 ` adhemerval.zanella at linaro dot org
3 siblings, 0 replies; 5+ messages in thread
From: adrian.ratiu at collabora dot com @ 2024-02-05 15:57 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31339
--- Comment #2 from Adrian Ratiu <adrian.ratiu at collabora dot com> ---
Thanks again Adhemerval for the prompt response, you are awesome.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [Bug libc/31339] arm32 loader crash after cleanup in 2.36
2024-02-05 11:44 [Bug libc/31339] New: arm32 loader crash after cleanup in 2.36 adrian.ratiu at collabora dot com
` (2 preceding siblings ...)
2024-02-05 15:57 ` adrian.ratiu at collabora dot com
@ 2024-02-05 18:44 ` adhemerval.zanella at linaro dot org
3 siblings, 0 replies; 5+ messages in thread
From: adhemerval.zanella at linaro dot org @ 2024-02-05 18:44 UTC (permalink / raw)
To: glibc-bugs
https://sourceware.org/bugzilla/show_bug.cgi?id=31339
Adhemerval Zanella <adhemerval.zanella at linaro dot org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Target Milestone|--- |2.40
Status|UNCONFIRMED |RESOLVED
--- Comment #3 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
Fixed on 2.40, I will backport to the affected versions.
--
You are receiving this mail because:
You are on the CC list for the bug.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-02-05 18:44 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-02-05 11:44 [Bug libc/31339] New: arm32 loader crash after cleanup in 2.36 adrian.ratiu at collabora dot com
2024-02-05 11:48 ` [Bug libc/31339] " adrian.ratiu at collabora dot com
2024-02-05 14:38 ` adhemerval.zanella at linaro dot org
2024-02-05 15:57 ` adrian.ratiu at collabora dot com
2024-02-05 18:44 ` adhemerval.zanella at linaro dot org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).