[Bug libc/33112] New: Hardened ldconfig crashes when running on Google Axion (arm64)

[sergiodj at sergiodj dot net]

https://sourceware.org/bugzilla/show_bug.cgi?id=33112

            Bug ID: 33112
           Summary: Hardened ldconfig crashes when running on Google Axion
                    (arm64)
           Product: glibc
           Version: 2.41
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: sergiodj at sergiodj dot net
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Hi,

We found yet another problem when hardening glibc.  This time, the issue
happens only when running "ldconfig" (possibly other binaries?) on the Google
Axion arm64 architecture.

After some debugging, we found a few things:

- The backtrace is:

(gdb) bt
#0  0x0000000000000560 in ?? ()
#1  0x0000ffff7fe4672c in prefer_sve_ifuncs ()
#2  0x0000ffff7fe46c60 [PAC] in __libc_start_main_impl ()
#3  0x0000ffff7fe40db0 [PAC] in _start ()

- prefer_sve_ifuncs has the following #if:

#if __LINUX_KERNEL_VERSION < 0x060200

https://sourceware.org/cgit/glibc/tree/sysdeps/unix/sysv/linux/aarch64/cpu-features.c#n66

I was surprised to see that the function was compiled in glibc, especially
because the Linux headers I have installed during build time are:

$ cat /usr/include/linux/version.h 
#define LINUX_VERSION_CODE 397059
#define KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + ((c) > 255 ? 255 :
(c)))
#define LINUX_VERSION_MAJOR 6
#define LINUX_VERSION_PATCHLEVEL 15
#define LINUX_VERSION_SUBLEVEL 3

but here's what glibc found to be __LINUX_KERNEL_VERSION:

./build/config.h:#define __LINUX_KERNEL_VERSION_STR "4.9.0"

Maybe there's a problem when determining the Linux kernel version?

- I found that if I remove the call to prefer_sve_ifuncs at init_cpu_features,
ldconfig works fine again.  As I said in the beginning, I am not sure whether
other binaries might be affected by this problem (e.g., we're cherry-picking
commit 0f044be1dae5169d0e57f8d487b427863aeadab4 which also calls
prefer_sve_ifuncs on select_memset_ifunc).

https://sourceware.org/cgit/glibc/tree/sysdeps/unix/sysv/linux/aarch64/cpu-features.c#n174



Here's the recipe to build glibc that we're using:

https://github.com/wolfi-dev/os/blob/main/glibc.yaml

(Ignore the GCC_SPEC_FILE set to /dev/null; I did it because we had to revert
the hardening for now)

Here's the spec file we're using:

https://github.com/wolfi-dev/os/blob/main/openssf-compiler-options/usr/lib/gcc/aarch64-unknown-linux-gnu/15/openssf.spec

I'm happy to provide whatever extra information

-- 
You are receiving this mail because:
You are on the CC list for the bug.