blob: 46d205808e3d3306234ebb83320a4ad93f4eb3b5 [file] [log] [blame]
Brad Bishop19323692019-04-05 15:28:33 -04001From 50ad00401eb16bb88c57d95bc927deeec4033e01 Mon Sep 17 00:00:00 2001
Brad Bishop1a4b7ee2018-12-16 17:11:34 -08002From: Khem Raj <raj.khem@gmail.com>
3Date: Wed, 18 Mar 2015 00:20:09 +0000
Brad Bishop19323692019-04-05 15:28:33 -04004Subject: [PATCH 10/30] Quote from bug 1443 which explains what the patch does
5 :
Brad Bishop1a4b7ee2018-12-16 17:11:34 -08006
7 We build some random program and link it with -lust. When we run it,
8 it dies with a SIGSEGV before reaching main().
9
10 Libust.so depends on liburcu-bp.so from the usermode-rcu package.
11 Although libust.so is not prelinked, liburcu-bp.so IS prelinked; this
12 is critical.
13
14 Libust.so uses a TLS / __thread variable that is defined in liburcu-
15 bp.so. There are special ARM-specific relocation types that allow two
16 shared libraries to share thread-specific data. This is critical too.
17
18 One more critical issue: although liburcu-bp.so is prelinked, we can't
19 load it at its prelinked address, because we also link against
20 librt.so, and librt.so uses that address.
21
22 The dynamic linker is forced to relink liburcu-bp.so at a different
23 address. In the course of relinking, it processes the special ARM
24 relocation record mentioned above. The prelinker has already filled
25 in the information, which is a short offset into a table of thread-
26 specific data that is allocated per-thread for each library that uses
27 TLS. Because the normal behavior of a relocation is to add the symbol
28 value to an addend stored at the address being relocated, we end up
29 adding the short offset to itself, doubling it.
30
31 Now we have an awkward situation. The libust.so library doesn't know
32 about the addend, so its TLS data for this element is correct. The
33 liburcu-bp.so library has a different offset for the element. When we
34 go to initialize the element for the first time in liburcu-bp.so, we
35 write the address of the result at the doubled (broken) offset.
36 Later, when we refer to the address from libust.so, we check the value
37 at the correct offset, but it's NULL, so we eat hot SIGSEGV.
38
39Upstream-Status: Pending
40
41Signed-off-by: Andrei Dinu <andrei.adrianx.dinu@intel.com>
42Signed-off-by: Khem Raj <raj.khem@gmail.com>
43---
44 sysdeps/arm/dl-machine.h | 2 +-
45 1 file changed, 1 insertion(+), 1 deletion(-)
46
47diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h
Brad Bishop19323692019-04-05 15:28:33 -040048index 7a2f9d9b78..36a1dd1888 100644
Brad Bishop1a4b7ee2018-12-16 17:11:34 -080049--- a/sysdeps/arm/dl-machine.h
50+++ b/sysdeps/arm/dl-machine.h
51@@ -510,7 +510,7 @@ elf_machine_rel (struct link_map *map, const Elf32_Rel *reloc,
52
53 case R_ARM_TLS_DTPOFF32:
54 if (sym != NULL)
55- *reloc_addr += sym->st_value;
56+ *reloc_addr = sym->st_value;
57 break;
58
59 case R_ARM_TLS_TPOFF32:
Brad Bishop19323692019-04-05 15:28:33 -040060--
612.20.1
62