[Bug libc/33112] Hardened ldconfig crashes when running on Google Axion (arm64)
sergiodj at sergiodj dot net
sourceware-bugzilla@sourceware.org
Fri Jun 27 01:27:10 GMT 2025
https://sourceware.org/bugzilla/show_bug.cgi?id=33112
--- Comment #6 from Sergio Durigan Junior <sergiodj at sergiodj dot net> ---
This is the disassemble for prefer_sve_ifuncs *without* hardening (which does
not crash):
(gdb) disassemble
Dump of assembler code for function prefer_sve_ifuncs:
0x0000ffff867b6188 <+0>: stp x29, x30, [sp, #-416]!
0x0000ffff867b618c <+4>: mov x29, sp
0x0000ffff867b6190 <+8>: add x0, sp, #0x18
=> 0x0000ffff867b6194 <+12>: bl 0xffff867d8dc0 <uname>
0x0000ffff867b6198 <+16>: mov w1, #0x1 // #1
0x0000ffff867b619c <+20>: tbnz w0, #31, 0xffff867b622c
<prefer_sve_ifuncs+164>
0x0000ffff867b61a0 <+24>: mov w4, #0x10 // #16
0x0000ffff867b61a4 <+28>: mov w5, #0x0 // #0
0x0000ffff867b61a8 <+32>: add x3, sp, #0x9a
0x0000ffff867b61ac <+36>: ldrb w2, [x3]
0x0000ffff867b61b0 <+40>: mov w0, #0x0 // #0
0x0000ffff867b61b4 <+44>: sub w1, w2, #0x30
0x0000ffff867b61b8 <+48>: and w1, w1, #0xff
0x0000ffff867b61bc <+52>: cmp w1, #0x9
0x0000ffff867b61c0 <+56>: b.hi 0xffff867b61e4 <prefer_sve_ifuncs+92>
// b.pmore
0x0000ffff867b61c4 <+60>: add w0, w0, w0, lsl #2
0x0000ffff867b61c8 <+64>: add w0, w2, w0, lsl #1
0x0000ffff867b61cc <+68>: ldrb w2, [x3, #1]!
0x0000ffff867b61d0 <+72>: sub w0, w0, #0x30
0x0000ffff867b61d4 <+76>: sub w1, w2, #0x30
0x0000ffff867b61d8 <+80>: and w1, w1, #0xff
0x0000ffff867b61dc <+84>: cmp w1, #0x9
0x0000ffff867b61e0 <+88>: b.ls 0xffff867b61c4 <prefer_sve_ifuncs+60>
// b.plast
0x0000ffff867b61e4 <+92>: and w0, w0, #0xff
0x0000ffff867b61e8 <+96>: lsl w0, w0, w4
0x0000ffff867b61ec <+100>: orr w5, w5, w0
0x0000ffff867b61f0 <+104>: cmp w2, #0x2e
0x0000ffff867b61f4 <+108>: b.ne 0xffff867b6208 <prefer_sve_ifuncs+128>
// b.any
0x0000ffff867b61f8 <+112>: sub w4, w4, #0x8
0x0000ffff867b61fc <+116>: add x3, x3, #0x1
0x0000ffff867b6200 <+120>: cmn w4, #0x8
0x0000ffff867b6204 <+124>: b.ne 0xffff867b61ac <prefer_sve_ifuncs+36>
// b.any
0x0000ffff867b6208 <+128>: sub w1, w5, #0x40, lsl #12
0x0000ffff867b620c <+132>: mov w0, #0xf2ff //
#62207
0x0000ffff867b6210 <+136>: sub w1, w1, #0xf00
0x0000ffff867b6214 <+140>: movk w0, #0x1, lsl #16
0x0000ffff867b6218 <+144>: cmp w1, w0
0x0000ffff867b621c <+148>: mov w0, #0xe00 //
#3584
0x0000ffff867b6220 <+152>: movk w0, #0x5, lsl #16
0x0000ffff867b6224 <+156>: ccmp w5, w0, #0x4, ls // ls = plast
0x0000ffff867b6228 <+160>: cset w1, eq // eq = none
0x0000ffff867b622c <+164>: mov w0, w1
0x0000ffff867b6230 <+168>: ldp x29, x30, [sp], #416
0x0000ffff867b6234 <+172>: ret
End of assembler dump.
This is the disassemble for prefer_sve_ifuncs *without* hardening (which does
not crash):
(gdb) disassemble
Dump of assembler code for function prefer_sve_ifuncs:
0x0000ffffb59e6710 <+0>: mov w1, #0x0 // #0
0x0000ffffb59e6714 <+4>: paciasp
0x0000ffffb59e6718 <+8>: mov x2, #0x186 // #390
0x0000ffffb59e671c <+12>: stp x29, x30, [sp, #-416]!
0x0000ffffb59e6720 <+16>: mov x29, sp
0x0000ffffb59e6724 <+20>: add x0, sp, #0x18
=> 0x0000ffffb59e6728 <+24>: bl 0xffffb59e05c8
0x0000ffffb59e672c <+28>: bl 0xffffb5a0af80 <uname>
0x0000ffffb59e6730 <+32>: mov w1, #0x1 // #1
0x0000ffffb59e6734 <+36>: tbnz w0, #31, 0xffffb59e67c8
<prefer_sve_ifuncs+184>
0x0000ffffb59e6738 <+40>: mov w4, #0x10 // #16
0x0000ffffb59e673c <+44>: mov w5, #0x0 // #0
0x0000ffffb59e6740 <+48>: add x3, sp, #0x9a
0x0000ffffb59e6744 <+52>: ldrb w2, [x3]
0x0000ffffb59e6748 <+56>: mov w0, #0x0 // #0
0x0000ffffb59e674c <+60>: sub w1, w2, #0x30
0x0000ffffb59e6750 <+64>: and w1, w1, #0xff
0x0000ffffb59e6754 <+68>: cmp w1, #0x9
0x0000ffffb59e6758 <+72>: b.hi 0xffffb59e6780 <prefer_sve_ifuncs+112>
// b.pmore
0x0000ffffb59e675c <+76>: nop
0x0000ffffb59e6760 <+80>: add w0, w0, w0, lsl #2
0x0000ffffb59e6764 <+84>: add w0, w2, w0, lsl #1
0x0000ffffb59e6768 <+88>: ldrb w2, [x3, #1]!
0x0000ffffb59e676c <+92>: sub w0, w0, #0x30
0x0000ffffb59e6770 <+96>: sub w1, w2, #0x30
0x0000ffffb59e6774 <+100>: and w1, w1, #0xff
0x0000ffffb59e6778 <+104>: cmp w1, #0x9
0x0000ffffb59e677c <+108>: b.ls 0xffffb59e6760 <prefer_sve_ifuncs+80>
// b.plast
0x0000ffffb59e6780 <+112>: and w0, w0, #0xff
0x0000ffffb59e6784 <+116>: lsl w0, w0, w4
0x0000ffffb59e6788 <+120>: orr w5, w5, w0
0x0000ffffb59e678c <+124>: cmp w2, #0x2e
0x0000ffffb59e6790 <+128>: b.ne 0xffffb59e67a4 <prefer_sve_ifuncs+148>
// b.any
0x0000ffffb59e6794 <+132>: sub w4, w4, #0x8
0x0000ffffb59e6798 <+136>: add x3, x3, #0x1
0x0000ffffb59e679c <+140>: cmn w4, #0x8
0x0000ffffb59e67a0 <+144>: b.ne 0xffffb59e6744 <prefer_sve_ifuncs+52>
// b.any
0x0000ffffb59e67a4 <+148>: sub w1, w5, #0x40, lsl #12
0x0000ffffb59e67a8 <+152>: mov w0, #0xf2ff //
#62207
0x0000ffffb59e67ac <+156>: sub w1, w1, #0xf00
0x0000ffffb59e67b0 <+160>: movk w0, #0x1, lsl #16
0x0000ffffb59e67b4 <+164>: cmp w1, w0
0x0000ffffb59e67b8 <+168>: mov w0, #0xe00 //
#3584
0x0000ffffb59e67bc <+172>: movk w0, #0x5, lsl #16
0x0000ffffb59e67c0 <+176>: ccmp w5, w0, #0x4, ls // ls = plast
0x0000ffffb59e67c4 <+180>: cset w1, eq // eq = none
0x0000ffffb59e67c8 <+184>: mov w0, w1
0x0000ffffb59e67cc <+188>: ldp x29, x30, [sp], #416
0x0000ffffb59e67d0 <+192>: autiasp
0x0000ffffb59e67d4 <+196>: ret
End of assembler dump.
Disassembling the address that "bl" wants to branch to:
(gdb) x/10i 0xffffb59e05c8
0xffffb59e05c8: bti c
0xffffb59e05cc: adrp x16, 0xffffb5aaf000 <tunable_list+2832>
0xffffb59e05d0: ldr x17, [x16, #3032]
0xffffb59e05d4: add x16, x16, #0xbd8
0xffffb59e05d8: br x17
0xffffb59e05dc: nop
0xffffb59e05e0: bti c
0xffffb59e05e4: adrp x16, 0xffffb5aaf000 <tunable_list+2832>
0xffffb59e05e8: ldr x17, [x16, #3040]
0xffffb59e05ec: add x16, x16, #0xbe0
$x17 will contain 0x560, which is the addres "br" will jump to and eventually
lead to the crash.
--
You are receiving this mail because:
You are on the CC list for the bug.
More information about the Glibc-bugs
mailing list