bti enabled glibc does not handle elf binaries correctly that have an executable load segment with virtual address that is not page aligned. mprotect fails, which is currently treated as fatal error. i think the bfd linker does not produce such binaries, but lld does that by default, typical exe layout: Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align PHDR 0x000040 0x0000000000200040 0x0000000000200040 0x0002d8 0x0002d8 R 0x8 INTERP 0x000318 0x0000000000200318 0x0000000000200318 0x00001b 0x00001b R 0x1 [Requesting program interpreter: /lib/ld-linux-aarch64.so.1] LOAD 0x000000 0x0000000000200000 0x0000000000200000 0x000704 0x000704 R 0x10000 LOAD 0x000710 0x0000000000210710 0x0000000000210710 0x000290 0x000290 R E 0x10000 LOAD 0x0009a0 0x00000000002209a0 0x00000000002209a0 0x0001c8 0x0001c8 RW 0x10000 LOAD 0x000b68 0x0000000000230b68 0x0000000000230b68 0x000048 0x000049 RW 0x10000 DYNAMIC 0x0009b0 0x00000000002209b0 0x00000000002209b0 0x0001b0 0x0001b0 RW 0x8 GNU_RELRO 0x0009a0 0x00000000002209a0 0x00000000002209a0 0x0001c8 0x000660 R 0x1 GNU_EH_FRAME 0x0005bc 0x00000000002005bc 0x00000000002005bc 0x000044 0x000044 R 0x4 GNU_STACK 0x000000 0x0000000000000000 0x0000000000000000 0x000000 0x000000 RW 0 GNU_PROPERTY 0x000358 0x0000000000200358 0x0000000000200358 0x000020 0x000020 R 0x8 NOTE 0x000334 0x0000000000200334 0x0000000000200334 0x000020 0x000020 R 0x4 NOTE 0x000358 0x0000000000200358 0x0000000000200358 0x000020 0x000020 R 0x8 (i.e. the readonly program headers and notes are not covered by the executable load segment and there is no page alignment either: with bfd linker either program headers are covered or executable segment has an alignment gap.)
The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=8b8f616e6a594b91d0afb152384bf2a9f72b7288 commit 8b8f616e6a594b91d0afb152384bf2a9f72b7288 Author: Szabolcs Nagy <szabolcs.nagy@arm.com> Date: Tue Dec 1 10:12:32 2020 +0000 aarch64: align address for BTI protection [BZ #26988] Handle unaligned executable load segments (the bfd linker is not expected to produce such binaries, but other linkers may). Computing the mapping bounds follows _dl_map_object_from_fd more closely now. Fixes bug 26988. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
fixed for 2.33, needs backport
The release/2.32/master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=c6090dcebd1fc2a39a95b6fd420e072a2039a81b commit c6090dcebd1fc2a39a95b6fd420e072a2039a81b Author: Szabolcs Nagy <szabolcs.nagy@arm.com> Date: Tue Dec 1 10:12:32 2020 +0000 aarch64: align address for BTI protection [BZ #26988] Handle unaligned executable load segments (the bfd linker is not expected to produce such binaries, but other linkers may). Computing the mapping bounds follows _dl_map_object_from_fd more closely now. Fixes bug 26988. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org> (cherry picked from commit 8b8f616e6a594b91d0afb152384bf2a9f72b7288)