Possible glibc 2.35 ARM regression in LD_BIND_NOT

[Nathan Nye <nnye@whitebeamsec.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 687 bytes --]

Good afternoon,

I'm reviewing what could be a regression in LD_BIND_NOT's functionality 
in glibc 2.35 on ARM architectures (there were a few recent ARM audit 
changes). Symbol binding only occurs a single time on glibc 2.35/ARM, 
even when LD_BIND_NOT is enabled. I've tested:

  * Ubuntu 22.04 x86_64 glibc 2.35
  * Ubuntu 20.04 ARM glibc 2.34
  * Ubuntu 22.04 ARM glibc 2.35

I could use a second pair of eyes on this issue to verify it exists. 
Here is the test case I cobbled together, please excuse the poor C code 
I wrote while testing: https://pastebin.com/raw/HSSYjemj

I've also attached the test case to this email. Thanks!

Very respectfully,
Nathan Nye

[-- Attachment #1.1.2: ldbindnot235.txt --]
[-- Type: text/plain, Size: 1214 bytes --]

runevp.c:
// gcc runevp.c -o runevp
#include <stdio.h>
#include <unistd.h>

int main() {
    int i;
    for (i=0; i < 5; i++) {
        if(fork()==0) {
            execvp("true", NULL);
        }
    }
    return 0;
}

auditlib.c:
// gcc -Wall -fPIC -shared -o auditlib.so auditlib.c
#include <link.h>
#include <stdio.h>
typedef long int Lmid_t;
unsigned int la_version(unsigned int version) { return version; }
unsigned int la_objopen(struct link_map *map, Lmid_t lmid, uintptr_t *cookie) { return 3; }
uintptr_t la_symbind64(Elf64_Sym *sym, unsigned int ndx, uintptr_t *refcook, uintptr_t *defcook, unsigned int *flags, const char *symname) {
    if (strcmp(symname, "execvp") == 0) {
        printf("symbol binding for '%s'\n", symname);
    }
    return sym->st_value;
}

Any glibc release except glibc 2.35 on ARM: Symbol binding occurs repeatedly (LD_BIND_NOT)
$ LD_AUDIT=/path/to/auditlib.so LD_BIND_NOT=1 ./runevp
symbol binding for 'execvp'
symbol binding for 'execvp'
symbol binding for 'execvp'
symbol binding for 'execvp'
symbol binding for 'execvp'

glibc 2.35 on ARM: Symbol binding occurs once (ignores LD_BIND_NOT)
$ LD_AUDIT=/path/to/auditlib.so LD_BIND_NOT=1 ./runevp
symbol binding for 'execvp'

[-- Attachment #1.1.3: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 673 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]