[Bug libc/31339] arm32 loader crash after cleanup in 2.36
adhemerval.zanella at linaro dot org
sourceware-bugzilla@sourceware.org
Mon Feb 5 14:38:49 GMT 2024
https://sourceware.org/bugzilla/show_bug.cgi?id=31339
--- Comment #1 from Adhemerval Zanella <adhemerval.zanella at linaro dot org> ---
It is indeed a overlook from my patch, previous
49d877a80b29d3002887b084eec6676d9f5fec18 r4 would hold the address of the
_SKIP_ARGS which would have a R_ARM_GOTOFF32 relocation, and this would be used
later on _dl_start_user to get the _dl_skip_args value after ld.so
self-relocate itself.
I haven't seen this on my tests because the kernel initializes r4 to 0, so
later the 'ld r4, [sl, r4]' will trigger the read of the _GLOBAL_OFFSET_TABLE_.
But it does trigger invalid memory access if the kernel, or the simulator, does
not ensure that r4 is 0 initialized.
I will send a patch to fix it.
--
You are receiving this mail because:
You are on the CC list for the bug.
More information about the Glibc-bugs
mailing list