From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 18843 invoked by alias); 15 Jan 2009 20:35:49 -0000 Received: (qmail 18833 invoked by uid 22791); 15 Jan 2009 20:35:48 -0000 X-SWARE-Spam-Status: No, hits=-2.3 required=5.0 tests=AWL,BAYES_00,SPF_PASS X-Spam-Check-By: sourceware.org Received: from mail.codesourcery.com (HELO mail.codesourcery.com) (65.74.133.4) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 15 Jan 2009 20:35:11 +0000 Received: (qmail 15613 invoked from network); 15 Jan 2009 20:35:08 -0000 Received: from unknown (HELO digraph.polyomino.org.uk) (joseph@127.0.0.2) by mail.codesourcery.com with ESMTPA; 15 Jan 2009 20:35:08 -0000 Received: from jsm28 (helo=localhost) by digraph.polyomino.org.uk with local-esmtp (Exim 4.68) (envelope-from ) id 1LNYvj-0000VC-40 for prelink@sourceware.org; Thu, 15 Jan 2009 20:35:07 +0000 Date: Thu, 15 Jan 2009 20:35:00 -0000 From: "Joseph S. Myers" To: prelink@sourceware.org Subject: Fix prelink bug with small data on PowerPC Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Mailing-List: contact prelink-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: prelink-owner@sourceware.org X-SW-Source: 2009-q1/txt/msg00001.txt.bz2 This patch fixes a prelinker bug that appears on PowerPC with small data. I do not have a reduced testcase for this bug, only a large filesystem. The failure involves uninitialized memory reads so reducing tests is likely to be difficult. A binary that exemplifies the problem has exactly two copy relocations: 10017bec R_PPC_COPY stderr 10017bf0 R_PPC_COPY optarg which relate to words in successive sections: 23 .sbss 00000004 10017bec 10017bec 00007bec 2**2 ALLOC 24 .bss 00000130 10017bf0 10017bf0 00007bec 2**3 ALLOC The logic for handling multiple BSS sections looks for the first copy relocation, in a sorted list, that is outside the first section. Because this logic uses > instead of >=, it fails to detect a relocation pointing immediately after the end of the first section. In this case, there are no copy relocations pointing later in the second section, so the loop ends with i == 2 rather than with a break and then the code starts looking at the uninitialized cr.rela[i].r_offset value. The fix simply makes the code use >=. Please commit if OK. 2009-01-15 Joseph Myers * src/conflict.c (prelink_build_conflicts): Use >= not > to determine whether a relocation points outside the first bss section. Index: src/conflict.c =================================================================== --- src/conflict.c (revision 164) +++ src/conflict.c (working copy) @@ -651,7 +651,7 @@ { for (i = 1; i < cr.count; ++i) if (cr.rela[i].r_offset - > dso->shdr[bss1].sh_addr + dso->shdr[bss1].sh_size) + >= dso->shdr[bss1].sh_addr + dso->shdr[bss1].sh_size) break; if (cr.rela[i].r_offset < dso->shdr[bss2].sh_addr) { -- Joseph S. Myers joseph@codesourcery.com