[Bug libc/1006] New: ld.so does backwards R_SPARC_WDISP30 relocations wrongly

["pdh at utter dot chaos dot org dot uk" <sourceware-bugzilla at sources dot redhat dot com>]

The code for R_SPARC_WDISP30 relocations at about line 326 of
sysdeps/sparc/sparc64/dl-machine.h doesn't cope with backwards calls: if "value
- reloc_addr" comes out as a negative 64-bit quantity, then bits 31 and 30 of
the result get set, incorrectly.

This causes SIGILL when the resulting code is executed. Modern binutils lays
down such WDISP30 relocations for calls to other routines in the same
translation unit. In particular, this happens when I build zlib and then someone
(e.g. a PNG decoder in the GTK+2 build system) calls zlib's inflateInit, which
has a backwards call to inflateInit2 (just before it in memory) that is laid
down as a R_SPARC_WDISP30 relocation. Applying the patch below fixes the SIGILL
problem.

Sparc64 Linux (64-bit userland), GCC 3.3.5, binutils 2.15.94.0.2.2, problem
observed using glibc 2.3.2 but identical code appears in 2.3.5.

Code before dynamic linking (with stock glibc):

--- glibc-2.3.2/sysdeps/sparc/sparc64/dl-machine.h~     2002-09-28 04:35:31 +0100
+++ glibc-2.3.2/sysdeps/sparc/sparc64/dl-machine.h      2005-06-12 01:03:48 +0100
@@ -322,7 +322,7 @@ elf_machine_rela (struct link_map *map, 
        case R_SPARC_WDISP30:
          *(unsigned int *) reloc_addr =
            ((*(unsigned int *)reloc_addr & 0xc0000000) |
-            ((value - (Elf64_Addr) reloc_addr) >> 2));
+            (((value - (Elf64_Addr) reloc_addr) >> 2) & 0x3fffffff));
          break;
 
        /* MEDLOW code model relocs */

-- 
           Summary: ld.so does backwards R_SPARC_WDISP30 relocations wrongly
           Product: glibc
           Version: 2.3.5
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: gotom at debian dot or dot jp
        ReportedBy: pdh at utter dot chaos dot org dot uk
                CC: glibc-bugs at sources dot redhat dot com
 GCC build triplet: sparc64-unknown-linux
  GCC host triplet: sparc64-unknown-linux
GCC target triplet: sparc64-unknown-linux


http://sources.redhat.com/bugzilla/show_bug.cgi?id=1006

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.