283b1ce2e8
Upstream commit: 71fcdba577884627c3ee4e43beb915da752efb1f - linux: Use rseq area unconditionally in sched_getcpu (bug 31479) - Use gcc __builtin_stdc_* builtins in stdbit.h if possible - S390: Do not clobber r7 in clone [BZ #31402] - math: Update mips64 ulps - mips: FIx clone3 implementation (BZ 31325) - arm: Remove wrong ldr from _dl_start_user (BZ 31339) - Replace advisories directory Related: RHEL-25850 Fedora 40 commit: 68abc16af72f1726f3fad3369bab8b812b306bbc
36 lines
1.4 KiB
Diff
36 lines
1.4 KiB
Diff
commit 63295e4fda1f6dab4bf7442706fe303bf283036c
|
|
Author: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
|
Date: Mon Feb 5 16:10:24 2024 +0000
|
|
|
|
arm: Remove wrong ldr from _dl_start_user (BZ 31339)
|
|
|
|
The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove
|
|
_dl_skip_args usage) removed the _SKIP_ARGS literal, which was
|
|
previously loader to r4 on loader _start. However, the cleanup did not
|
|
remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check
|
|
to skip the arguments after ld self-relocations.
|
|
|
|
In my testing, the kernel initially set r4 to 0, which makes the
|
|
ldr instruction just read the _GLOBAL_OFFSET_TABLE_. However, since r4
|
|
is a callee-saved register; a different runtime might not zero
|
|
initialize it and thus trigger an invalid memory access.
|
|
|
|
Checked on arm-linux-gnu.
|
|
|
|
Reported-by: Adrian Ratiu <adrian.ratiu@collabora.com>
|
|
Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
|
|
(cherry picked from commit 1e25112dc0cb2515d27d8d178b1ecce778a9d37a)
|
|
|
|
diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h
|
|
index b857bbc868ea2ce4..dd1a0f6b6e7a5ea8 100644
|
|
--- a/sysdeps/arm/dl-machine.h
|
|
+++ b/sysdeps/arm/dl-machine.h
|
|
@@ -139,7 +139,6 @@ _start:\n\
|
|
_dl_start_user:\n\
|
|
adr r6, .L_GET_GOT\n\
|
|
add sl, sl, r6\n\
|
|
- ldr r4, [sl, r4]\n\
|
|
@ save the entry point in another register\n\
|
|
mov r6, r0\n\
|
|
@ get the original arg count\n\
|