Bug 26798 - aarch64: variant PCS symbols may be incorrectly lazy bound
Summary: aarch64: variant PCS symbols may be incorrectly lazy bound
Status: RESOLVED FIXED
Alias: None
Product: glibc
Classification: Unclassified
Component: dynamic-link (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: 2.33
Assignee: Szabolcs Nagy
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-10-28 09:23 UTC by Szabolcs Nagy
Modified: 2020-11-04 12:45 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Szabolcs Nagy 2020-10-28 09:23:05 UTC
the original implementation for DT_AARCH64_VARIANT_PCS modules with
STO_AARCH64_VARIANT_PCS symbols intended to bind such symbols early,
but it can get lazy bound.

in fact in the common case they get lazy bound which means registers
get clobbered incorrectly during lazy binding which in practice mainly
affects SVE calls where argument registers get clobbered.
Comment 1 Sourceware Commits 2020-11-02 09:40:34 UTC
The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=558251bd8785760ad40fcbfeaaee5d27fa5b0fe4

commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
Comment 2 Sourceware Commits 2020-11-02 09:40:39 UTC
The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=e156dabc766d6f6f99ce9402999eae380a3ec1f2

commit e156dabc766d6f6f99ce9402999eae380a3ec1f2
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Mon Oct 26 15:48:01 2020 +0000

    aarch64: Add variant PCS lazy binding test [BZ #26798]
    
    This test fails without bug 26798 fixed because some integer registers
    likely get clobbered by lazy binding and variant PCS only allows x16
    and x17 to be clobbered at call time.
    
    The test requires binutils 2.32.1 or newer for handling variant PCS
    symbols. SVE registers are not covered by this test, to avoid the
    complexity of handling multiple compile- and runtime feature support
    cases.
Comment 3 Szabolcs Nagy 2020-11-02 13:33:19 UTC
fixed on master.
Comment 4 Sourceware Commits 2020-11-04 12:37:05 UTC
The release/2.32/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=70ee5e8b573f76745760dd6b75f705590fc1923a

commit 70ee5e8b573f76745760dd6b75f705590fc1923a
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
    
    (cherry picked from commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4)
Comment 5 Sourceware Commits 2020-11-04 12:39:16 UTC
The release/2.31/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8dc76056654f8013a54678461fb023e988a17256

commit 8dc76056654f8013a54678461fb023e988a17256
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
    
    (cherry picked from commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4)
Comment 6 Sourceware Commits 2020-11-04 12:40:33 UTC
The release/2.30/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=61e8ae9b660d98d3a139d3dd617dea16de798f88

commit 61e8ae9b660d98d3a139d3dd617dea16de798f88
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
    
    (cherry picked from commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4)
Comment 7 Sourceware Commits 2020-11-04 12:42:10 UTC
The release/2.29/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a3c78954ee0009e558b7e6b9eb05208814099e21

commit a3c78954ee0009e558b7e6b9eb05208814099e21
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
    
    (cherry picked from commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4)
Comment 8 Sourceware Commits 2020-11-04 12:44:31 UTC
The release/2.28/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d81114e0aaedc30d82956d3a21ae6777b3fbba3c

commit d81114e0aaedc30d82956d3a21ae6777b3fbba3c
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
    
    (cherry picked from commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4)
Comment 9 Sourceware Commits 2020-11-04 12:44:42 UTC
The release/2.27/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=dc7f51bda99fa8eceb7f9049c0a9827064ff7e85

commit dc7f51bda99fa8eceb7f9049c0a9827064ff7e85
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
    
    (cherry picked from commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4)
Comment 10 Sourceware Commits 2020-11-04 12:45:51 UTC
The release/2.26/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=268df5a91054fcb4284e8504afd086a769ec4c40

commit 268df5a91054fcb4284e8504afd086a769ec4c40
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Thu Oct 22 17:55:01 2020 +0100

    aarch64: Fix DT_AARCH64_VARIANT_PCS handling [BZ #26798]
    
    The variant PCS support was ineffective because in the common case
    linkmap->l_mach.plt == 0 but then the symbol table flags were ignored
    and normal lazy binding was used instead of resolving the relocs early.
    (This was a misunderstanding about how GOT[1] is setup by the linker.)
    
    In practice this mainly affects SVE calls when the vector length is
    more than 128 bits, then the top bits of the argument registers get
    clobbered during lazy binding.
    
    Fixes bug 26798.
    
    (cherry picked from commit 558251bd8785760ad40fcbfeaaee5d27fa5b0fe4)