commit 63295e4fda1f6dab4bf7442706fe303bf283036c
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
Date:   Mon Feb 5 16:10:24 2024 +0000

    arm: Remove wrong ldr from _dl_start_user (BZ 31339)
    
    The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove
    _dl_skip_args usage) removed the _SKIP_ARGS literal, which was
    previously loader to r4 on loader _start.  However, the cleanup did not
    remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check
    to skip the arguments after ld self-relocations.
    
    In my testing, the kernel initially set r4 to 0, which makes the
    ldr instruction just read the _GLOBAL_OFFSET_TABLE_.  However, since r4
    is a callee-saved register; a different runtime might not zero
    initialize it and thus trigger an invalid memory access.
    
    Checked on arm-linux-gnu.
    
    Reported-by: Adrian Ratiu <adrian.ratiu@collabora.com>
    Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
    (cherry picked from commit 1e25112dc0cb2515d27d8d178b1ecce778a9d37a)

diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h
index b857bbc868ea2ce4..dd1a0f6b6e7a5ea8 100644
--- a/sysdeps/arm/dl-machine.h
+++ b/sysdeps/arm/dl-machine.h
@@ -139,7 +139,6 @@ _start:\n\
 _dl_start_user:\n\
 	adr	r6, .L_GET_GOT\n\
 	add	sl, sl, r6\n\
-	ldr	r4, [sl, r4]\n\
 	@ save the entry point in another register\n\
 	mov	r6, r0\n\
 	@ get the original arg count\n\