Bug 9893 - LD_AUDIT - misaligned _dl_call_pltexit parameter causing crash in audit library
Summary: LD_AUDIT - misaligned _dl_call_pltexit parameter causing crash in audit library
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.8
: P2 normal
Target Milestone: ---
Assignee: Ulrich Drepper
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-02-24 20:08 UTC by Jiri Olsa
Modified: 2014-07-01 20:47 UTC (History)
2 users (show)

See Also:
Host: x86_64-*-linux-gnu
Target: x86_64-*-linux-gnu
Build: x86_64-*-linux-gnu
Last reconfirmed:
fweimer: security-


Attachments
audit library to reproduce the bug (520 bytes, text/plain)
2009-02-24 20:10 UTC, Jiri Olsa
Details
proposed patch, sent to libc-alpha also (2.23 KB, patch)
2009-03-10 19:39 UTC, Jiri Olsa
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Jiri Olsa 2009-02-24 20:08:09 UTC
The outregs parameter (struct La_x86_64_retval pointer) of _dl_call_pltexit
function is not aligned to 16. This is causing crash in the audit library.

When the audit library touches the lrv_xmm0 (or lrv_xmm1) member of the 
La_x86_64_retval, gcc will emit 'movaps' instructions which expect a
parameter aligned to 16, otherwise it segfaults.

In email discussion H.J. Lu mentioned: "According to x86-64 psABI,
La_x86_64_retval  should be aligned at 16byte"
(http://gcc.gnu.org/ml/gcc/2009-02/msg00346.html)

The issue can be reproduced by using attached audit.c as the audit library.

Here is the gdb session record showing the issue:

> ...
> (gdb) b _dl_call_pltexit
> Function "_dl_call_pltexit" not defined.
> Make breakpoint pending on future shared library load? (y or [n]) y
> Breakpoint 1 (_dl_call_pltexit) pending.
> (gdb) r
> Starting program: /opt/crash
> symbol __libc_start_main
> symbol printf
>
> Breakpoint 1, _dl_call_pltexit (l=0x7ffff7ffd000, reloc_offset=0,
> inregs=0x7fffffffe418, outregs=0x7fffffffe3c8) at dl-runtime.c:408
> 408     {
> (gdb)
Comment 1 Jiri Olsa 2009-02-24 20:10:15 UTC
Created attachment 3763 [details]
audit library to reproduce the bug
Comment 2 H.J. Lu 2009-02-24 20:35:32 UTC
Please provide step-by-step instructions to reproduce the bug.
Comment 3 Jiri Olsa 2009-03-10 19:39:19 UTC
Created attachment 3807 [details]
proposed patch, sent to libc-alpha also

proposed patch, sent to libc-alpha also
Comment 4 Ulrich Drepper 2009-03-14 23:57:49 UTC
The patch has a number of problems.  I've fixed those and applied it.