https://sourceware.org/bugzilla/show_bug.cgi?id=25384
Alan Modra <amodra at gmail dot com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
Version|unspecified |2.34 (HEAD)
Assignee|unassigned at sourceware dot org |amodra at gmail dot com
Target Milestone|--- |2.34
--- Comment #3 from Alan Modra <amodra at gmail dot com> ---
The trigger for this problem is an initialized function pointer in a read-only
section, the function being defined in a shared library.
.section .rodata
ptr:
.quad alias
.weakref alias, implementation
That generates a .dynbss copy and copy reloc via linker code supposed to work
around bugs in very old versions of gcc. The work-around should have reported
an error
if (h->plt.plist != NULL)
{
/* We should never get here, but unfortunately there are versions
of gcc out there that improperly (for this ABI) put initialized
function pointers, vtable refs and suchlike in read-only
sections. Allow them to proceed, but warn that this might
break at runtime. */
info->callbacks->einfo
(_("%P: copy reloc against `%T' requires lazy plt linking; "
"avoid setting LD_BIND_NOW=1 or upgrade gcc\n"),
h->root.root.string);
}
but doesn't due to a lack of a call to "implementation" in the executable.
(plt.plist is NULL). That's a linker bug. The warning is relevant even when
there is no call in the executable.
So we have this .dynbss copy of the "implementation" function descriptor in the
executable:
000000001001fc08 0000000800000013 R_PPC64_COPY 000000001001fc08
implementation + 0
8: 000000001001fc08 40 FUNC GLOBAL DEFAULT 18 implementation
Notice that the size (40) is incorrect for a function descriptor. That's
because gcc puts the text size of the function on the symbol. But that means
the .dynbss copy is the wrong size too, a linker and glibc bug if we are to
support .dynbss copies of function descriptors with versions of gcc since 2004
when dot-symbols were removed. (With dot-symbols, the size of the
"implementation symbol is the size of the function descriptor with the size of
".implementation" being the text size.)
Anyway, a size larger than 16 is OK for copying the descriptor and "works" just
as well for this testcase as if we copied the descriptor. We just get some
more of .opd copied from the library defining "implementation".
The segfault happens because the PLT slot in liblike-dl.so for "implementation"
is initialized from the function descriptor for "implementation", which is now
the copy in main. Unfortunately that initialization happens before "main" is
processed to initialize the copy, resulting in the PLT slot being set to zeros.
--
You are receiving this mail because:
You are on the CC list for the bug.
