Segfault when using LD_PROFILE

[Jeff Law]

LD_PROFILE=BLAH /usr/bin/gdb

Results in a segfault in the dynamic linker on my Fedora 16 system.


172       /* This is the address in the array where we store the result 
of previous
173          relocations.  */
174       struct reloc_result *reloc_result = 
&l->l_reloc_result[reloc_index];
175       DL_FIXUP_VALUE_TYPE *resultp = &reloc_result->addr;
176
177       DL_FIXUP_VALUE_TYPE value = *resultp;

The l_reloc_result field is NULL, which causes resultp to point to a 
near-NULL address and segfault at line 177.

We are processing an R_X86_64_IRELATIVE relocation for libm.

Looking at dl-reloc.c we have:
264     #include "dynamic-link.h"
265
266         ELF_DYNAMIC_RELOCATE (l, lazy, consider_profiling, skip_ifunc);
267
268     #ifndef PROF
269         if (__builtin_expect (consider_profiling, 0))
270           {
(gdb)
271             /* Allocate the array which will contain the already found
272                relocations.  If the shared object lacks a PLT (for 
example
273                if it only contains lead function) the 
l_info[DT_PLTRELSZ]
274                will be NULL.  */
275             if (l->l_info[DT_PLTRELSZ] == NULL)
276               {
277                 errstring = N_("%s: no PLTREL found in object %s\n");
278               fatal:
279                 _dl_fatal_printf (errstring,
280                                   rtld_progname ?: "<program name 
unknown>",
(gdb)
281                                   l->l_name);
282               }
283
284             l->l_reloc_result = calloc (sizeof (l->l_reloc_result[0]),
285 
l->l_info[DT_PLTRELSZ]->d_un.d_val);

Note that we call ELF_DYNAMIC_RELOCATE on line 266 prior to setting up 
l_reloc_result on line 284.


I'm not at all familiar with this code, but ISTM (and simple tests 
verify) that moving the block of code to allocate the array of already 
found relocations to a point before calling ELF_DYNAMIC_RELOCATE 
resolves this issue.

Comments?

jeff