Re: [PATCH] Fix glibc 2.34 ABI omission (missing GLIBC_2.34 in dynamic loader)

[Carlos O'Donell <carlos@redhat.com>]

On 12/13/21 09:54, Siddhesh Poyarekar wrote:
> On 12/13/21 17:45, Florian Weimer wrote:
>> It's only possible to move symbols if version nodes exist on both 
>> sides.  Therefore, this patch adds a version node to ld.so.
> 
> Could we enforce via a test that both libc.so and ld.so always have
> the same version nodes?  That'll give us future flexibility at the
> cost of the extra few bytes.

I agree this might be a nice addition to allow symbols to move between the objects.

I wouldn't block this patch on such a belt-and-suspenders check, but I agree that
checking if they have the same version notes would be useful. We haven't ever done
this in the past.
 
>> Without the version node, a binary linked against newer glibc will
>> start referencing GLIBC_2.34 in ld.so after a symbol move to ld.so.
>> The lazy
> 
> Would it contain a reference to ld.so though?  IIRC, the
> symbol/version checks don't care about the DSO in which they are
> found.  So in old glibc, it should resolve to
> pthread_key_create@GLIBC_2.34 in libc.so.6 and in newer glibc it
> should resolve to pthread_key_create@GLIBC_2.34 in ld.so.

They do care.

Unfixed:
LD_LIBRARY_PATH=. ./main-v2
./main-v2: ./lib2.so: version `FIRST_1.0' not found (required by ./main-v2)
./main-v2: ./lib1.so: version `FIRST_1.1' not found (required by ./main-v2)
- Loader looks to determine if version node is present in the referenced DSO.

e.g.
Version needs section '.gnu.version_r' contains 3 entries:
 Addr: 0x00000000004004f8  Offset: 0x0004f8  Link: 7 (.dynstr)
  000000: Version: 1  File: lib2.so  Cnt: 1
  0x0010:   Name: FIRST_1.0  Flags: none  Version: 5
  0x0020: Version: 1  File: lib1.so  Cnt: 1
  0x0030:   Name: FIRST_1.1  Flags: none  Version: 4
  0x0040: Version: 1  File: libc.so.6  Cnt: 2
  0x0050:   Name: GLIBC_2.2.5  Flags: none  Version: 3
  0x0060:   Name: GLIBC_2.34  Flags: none  Version: 2

Fixed:
LD_LIBRARY_PATH=. ./main-v2
first = 0, second = 42
- Loader finds both version nodes in the bound library.

While the symbol@version can move, if the version node is missing you still
get a diagnostic, and that forces you to add a completely new version, when
all you did was move the existing version.

There are two kinds of checks:

- Does my DSO contain the version nodes I expected?
- Does a DSO contain the symbol@version I expected?

We never relaxed the version node check because it's a useful first pass
check. We've always been moving symbols for which the target DSO had the
same version node.

-- 
Cheers,
Carlos.