Shared libraries built with multiple tocs resolve plt to local function entry

Bug #1341569 reported by bugproxy
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
glibc (Ubuntu)
Fix Released
Undecided
Unassigned
Trusty
New
Undecided
Unassigned
Utopic
Won't Fix
Undecided
Unassigned

Bug Description

-- Problem Description --
An optimisation in glibc is supposed to make calls within a shared library go to the local entry points, when DT_PPC64_OPT does *not* have bit 2 (PPC64_OPT_MULTI_TOC) set. See glibc/sysdeps/powerpc/powerpc64/dl-machine.h:ppc64_local_entry_offset.

Libraries correctly have the bit set, but glibc *is* applying the local offset.

When I look at the l_info in question, I see
p ((struct link_map *) 0x3fffb7f925d8)->l_info
$6 = {0x0, 0x3fffb7edaf58, 0x3fffb7edb028, 0x3fffb7edb018, 0x3fffb7edafc8,
  0x3fffb7edafd8, 0x3fffb7edafe8, 0x3fffb7edb078, 0x3fffb7edb088,
  0x3fffb7edb098, 0x3fffb7edaff8, 0x3fffb7edb008, 0x3fffb7edaf68,
  0x3fffb7edaf78, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fffb7edb038, 0x0, 0x0,
  0x3fffb7edb048, 0x0, 0x3fffb7edaf88, 0x3fffb7edafa8, 0x3fffb7edaf98,
  0x3fffb7edafb8, 0x0, 0x0, 0x0, 0x0, 0x0,
-------
  0x3fffb7edb058, 0x0, 0x0, 0x3fffb7edb0b8,
-------
  0x3fffb7edb0a8, 0x0, 0x0, 0x0, 0x0, 0x3fffb7edb0d8, 0x0,
  0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fffb7edb0c8, 0x0 <repeats 26 times>}

Highlighted part is the DT_PPC64 area, with DT_PPC64_OPT being the last one. It should be "0x2", but is overwritten with some other value due to DT_PPC64_NUM being one too small in the following from elf.h.

/* PowerPC64 specific values for the Dyn d_tag field. */
#define DT_PPC64_GLINK (DT_LOPROC + 0)
#define DT_PPC64_OPD (DT_LOPROC + 1)
#define DT_PPC64_OPDSZ (DT_LOPROC + 2)
#define DT_PPC64_OPT (DT_LOPROC + 3)
#define DT_PPC64_NUM 3

Fix applied for upstream bug https://sourceware.org/bugzilla/show_bug.cgi?id=17153
git revision f6c44d47

CVE References

bugproxy (bugproxy)
tags: added: architecture-ppc64le bugnameltc-113216 severity-medium
Luciano Chavez (lnx1138)
affects: ubuntu → glibc (Ubuntu)
bugproxy (bugproxy)
tags: added: targetmilestone-inin1410
Revision history for this message
bugproxy (bugproxy) wrote : Comment bridged from LTC Bugzilla

------- Comment From <email address hidden> 2014-10-09 15:48 EDT-------
According to upstream bug https://sourceware.org/bugzilla/show_bug.cgi?id=17153 it will be integrated to release 2.20.
Currently we are running:
$ dpkg -l |grep libc6
ii libc6:ppc64el 2.19-10ubuntu2 ppc64el GNU C Library: Shared libraries
ii libc6-dbg:ppc64el 2.19-10ubuntu2 ppc64el GNU C Library: detached debugging symbols
ii libc6-dev:ppc64el 2.19-10ubuntu2 ppc64el GNU C Library: Development Libraries and Header Files

and glibc-2.19$ head ChangeLog
2014-06-03 Guo Yixuan <email address hidden>

[BZ #16882]
* nptl/sysdeps/sparc/sparc32/pthread_spin_lock.S
(pthread_spin_lock): Branch out of spin loop to proper location.
* nptl/sysdeps/sparc/sparc64/pthread_spin_lock.S
(pthread_spin_lock): Likewise.

* nptl/tst-spin4.c: New test.
* nptl/Makefile (tests): Add tst-spin4.

so patch is not yet integrated.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (6.1 KiB)

This bug was fixed in the package glibc - 2.19-13ubuntu2

---------------
glibc (2.19-13ubuntu2) vivid; urgency=medium

  * No, really, remove obsolete /etc/ld.so.conf.d/i686-linux-gnu.conf.

glibc (2.19-13ubuntu1) vivid; urgency=medium

  * Merge with Debian unstable, pulling in upstream and package fixes.
  * Re-enable the testsuite that was disabled in Debian for the freeze.
  * Drop obsolete /etc/ld.so.conf.d/i686-linux-gnu.conf (LP: #1381656)
  * Update to release/2.19/master, and readjust patches to compensate:
    - localedata/unsubmitted-tst-setlocale3-ENV.diff: Superseded.
    - s390/cvs-s390-abi-reversal.diff: Superseded.
    - any/cvs-resolv-reuse-fd.diff: Superseded.
    - any/cvs-posix_spawn_file_actions_addopen.diff: Superseded.
    - any/cvs-setlocale-alloca.diff: Superseded.
    - any/cvs-CVE-2014-0475.diff: Superseded.
    - any/cvs-CVE-2014-5119.diff: Superseded.
    - any/cvs-CVE-2014-6040.diff: Superseded.
    - any/cvs-resolv-first-query-failure.diff: Rebased with upstream.
  * testsuite-checking: Ignore failures of the tst-dl-iter-static test,
    which are caused by the lddebug-scopes patch, while we work out a
    better solution upstream to the GDB versus linux-vdso.so.1 problem.
  * Pull in latest PPC fixes from ibm/2.19/master branch (LP: #1341569)

glibc (2.19-13) unstable; urgency=medium

  [ Aurelien Jarno ]
  * kfreebsd/local-fbtl.diff: update to revision 5677 (from glibc-bsd).
    Workarounds a kfreebsd 9.0 to 10.1 ABI break. Closes: #740509.
  * patches/hppa/cvs-sigrtmin.diff: backport patch from upstream to change
    __SIGRTMIN to match other architectures. Closes: #766605.
  * patches/amd64/cvs-slow-sse42.diff: backport patch from upstream to fix
    a performance issue with strcmp and friends functions on some machines.
  * patches/any/cvs-regex-alloca.diff: new patch from upstream to fix a
    segmentation fault in regex in case of heap allocation failure. Closes:
    #767225.
  * Don't fail to build in case of testsuite regressions, so that changes
    in the environment (e.g.: kernel) do not prevent security or stable
    versions to be built. It will be re-enabled after the Jessie release.
  * debian/control.in/main: build-depends on debhelper (>= 9.20141010) to
    get Build-Profiles features. This fixes the following lintian warning:
    restriction-formula-with-debhelper-without-debhelper-version.

  [ Samuel Thibault ]
  * hurd-i386/cvs-libpthread.diff: Update to Sun Nov 2.
  * hurd-i386/libpthread_clean.diff: Refresh, most of it merged into
    cvs-libpthread.diff.
  * hurd-i386/cvs-libpthread-pthread_condattr_setclock.diff,
    cvs-libpthread_guardsize.diff, cvs-libpthread_std_thread.diff: Remove,
    merged into cvs-libpthread.diff.

glibc (2.19-12) unstable; urgency=medium

  [ Samuel Thibault ]
  * patches/hurd-i386/tg-thread-cancel.diff: Update patch from upstream, fixes
    a rare deadlock.
  * patches/hurd-i386/local-libpthread-stacksize.diff: New patch to make
    libpthread stacks size default to 8MiB like on Linux, to avoid surprises
    with packages which assume the Linuxish default.
  * patches/hurd-i386/tg-poll_errors_fixes.diff: Update patch, fixes
    select returned value in case ...

Read more...

Changed in glibc (Ubuntu):
status: New → Fix Released
Revision history for this message
bugproxy (bugproxy) wrote :

* Update French manpages translations, by David Pr?vot. Closes: #715289.

bugproxy (bugproxy)
tags: added: targetmilestone-inin14042
removed: targetmilestone-inin1410
Rolf Leggewie (r0lf)
Changed in glibc (Ubuntu Utopic):
status: New → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.