diff options
| author |   Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2024-02-05 16:10:24 +0000 |
|---|---|---|
| committer |   Andreas K. Hüttel <dilfridge@gentoo.org> | 2024-02-19 01:43:50 +0100 |
| commit | 69f121bae0f64d8631cd48c302280375d8aa30fc (patch) | |
| tree | b672e69ca53cd0b3503adfad964b270ead3b23a4 | |
| parent | sparc: Remove unwind information from signal return stubs [BZ #31244] (diff) | |
| download | glibc-69f121bae0f64d8631cd48c302280375d8aa30fc.tar.gz glibc-69f121bae0f64d8631cd48c302280375d8aa30fc.tar.bz2 glibc-69f121bae0f64d8631cd48c302280375d8aa30fc.zip | |
arm: Remove wrong ldr from _dl_start_user (BZ 31339)
The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove
_dl_skip_args usage) removed the _SKIP_ARGS literal, which was
previously loader to r4 on loader _start. However, the cleanup did not
remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check
to skip the arguments after ld self-relocations.
In my testing, the kernel initially set r4 to 0, which makes the
ldr instruction just read the _GLOBAL_OFFSET_TABLE_. However, since r4
is a callee-saved register; a different runtime might not zero
initialize it and thus trigger an invalid memory access.
Checked on arm-linux-gnu.
Reported-by: Adrian Ratiu <adrian.ratiu@collabora.com>
Reviewed-by: Szabolcs Nagy <szabolcs.nagy@arm.com>
(cherry picked from commit 1e25112dc0cb2515d27d8d178b1ecce778a9d37a)
(cherry picked from commit b09073e63138ce409bf6426cf820eeaa0d28ca74)
| -rw-r--r-- | sysdeps/arm/dl-machine.h | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h index d720c02c96..77dc7415e9 100644 --- a/sysdeps/arm/dl-machine.h +++ b/sysdeps/arm/dl-machine.h @@ -137,7 +137,6 @@ _start:\n\ _dl_start_user:\n\ adr r6, .L_GET_GOT\n\ add sl, sl, r6\n\ - ldr r4, [sl, r4]\n\ @ save the entry point in another register\n\ mov r6, r0\n\ @ get the original arg count\n\ |