NetBSD Problem Report #50277
From www@NetBSD.org Sat Sep 26 02:36:49 2015
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(Client CN "mail.netbsd.org", Issuer "Postmaster NetBSD.org" (verified OK))
by mollari.NetBSD.org (Postfix) with ESMTPS id 7EC1DA57FE
for <gnats-bugs@gnats.NetBSD.org>; Sat, 26 Sep 2015 02:36:49 +0000 (UTC)
Message-Id: <20150926023648.00F84A6558@mollari.NetBSD.org>
Date: Sat, 26 Sep 2015 02:36:47 +0000 (UTC)
From: tnn@NetBSD.org
Reply-To: tnn@NetBSD.org
To: gnats-bugs@NetBSD.org
Subject: rtld relocation bug with thread local storage
X-Send-Pr-Version: www-1.0
>Number: 50277
>Category: toolchain
>Synopsis: rtld relocation bug with thread local storage
>Confidential: no
>Severity: non-critical
>Priority: medium
>Responsible: toolchain-manager
>State: closed
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Sat Sep 26 02:40:00 +0000 2015
>Closed-Date: Sat Aug 05 16:26:32 +0000 2023
>Last-Modified: Mon Aug 07 19:40:03 +0000 2023
>Originator: Tobias Nygren
>Release: 7.99.21
>Organization:
>Environment:
x86_64
>Description:
Here are the prerequisites to trigger the bug:
- shared library 1, which has a TLS symbol declared as extern
- shared library 2 provides the TLS symbol
- shared library 1 links with shared library 2 to get the TLS symbol
- main application dlopens shared library 1
With the above conditions satisfied the symbol will point to different addresses in each of the libraries' GOT!
>How-To-Repeat:
======= shlib1.c =======
extern __thread int mysym __attribute__((tls_model("initial-exec")));
int* func1() { return &mysym; }
======= shlib2.c =======
__thread int mysym __attribute__((tls_model("initial-exec"))) = 0;
int* func2() { return &mysym; }
======= main.c =======
#include <stdio.h>
#include <dlfcn.h>
int main(void) {
int* (*func1)();
int* (*func2)();
void* handle1 = dlopen("./libshlib1.so", 0);
void* handle2 = dlopen("./libshlib2.so", RTLD_NOLOAD);
func1 = dlsym(handle1, "func1");
func2 = dlsym(handle2, "func2");
if (func1() != func2())
printf("Should not happen! %p %p\n", func1(), func2());
}
======= build instructions =======
cc -g -fPIC -o libshlib2.so -shared shlib2.c
cc -g -fPIC -o libshlib1.so -L. -Wl,-R. -lshlib2 -shared shlib1.c
cc -g -fPIC -o main main.c
======= result =======
./main
Should not happen! 0x7f7ff7ffd0c0 0x7f7ff7ffd0bc
>Fix:
Not sure. Some kind of relocation issue. Moving the symbol from the second library to the first library seems to be a workaround.
>Release-Note:
>Audit-Trail:
From: Matt Thomas <matt@3am-software.com>
To: gnats-bugs@NetBSD.org,
tnn@netbsd.org
Cc: toolchain-manager@netbsd.org,
gnats-admin@netbsd.org,
netbsd-bugs@netbsd.org
Subject: Re: toolchain/50277: rtld relocation bug with thread local storage
Date: Fri, 25 Sep 2015 23:06:08 -0700
> On Sep 25, 2015, at 7:40 PM, tnn@netbsd.org wrote:
>=20
>> Number: 50277
>> Category: toolchain
>> Synopsis: rtld relocation bug with thread local storage
>> Confidential: no
>> Severity: non-critical
>> Priority: medium
>> Responsible: toolchain-manager
>> State: open
>> Class: sw-bug
>> Submitter-Id: net
>> Arrival-Date: Sat Sep 26 02:40:00 +0000 2015
>> Originator: Tobias Nygren
>> Release: 7.99.21
>> Organization:
>> Environment:
> x86_64
>> Description:
>=20
> =3D=3D=3D=3D=3D=3D=3D shlib2.c =3D=3D=3D=3D=3D=3D=3D
>=20
> __thread int mysym __attribute__((tls_model("initial-exec"))) =3D 0;
> int* func2() { return &mysym; }
>=20
I believe initial-exec is only valid for static programs, not one using =
shared libraries.=
From: Tobias Nygren <tnn@NetBSD.org>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: toolchain/50277: rtld relocation bug with thread local storage
Date: Sat, 26 Sep 2015 09:45:47 +0200
On Sat, 26 Sep 2015 06:10:05 +0000 (UTC)
Matt Thomas <matt@3am-software.com> wrote:
> I believe initial-exec is only valid for static programs, not one using =
> shared libraries.
I was told on pkgsrc-users@ last month that it should work, with some
limitations. It does appear to work in general. Only this corner case
is broken. (this caused problems for MesaLib's tls dispatch.)
From: Joerg Sonnenberger <joerg@britannica.bec.de>
To: gnats-bugs@NetBSD.org
Cc: toolchain-manager@netbsd.org, gnats-admin@netbsd.org,
netbsd-bugs@netbsd.org, tnn@NetBSD.org
Subject: Re: toolchain/50277: rtld relocation bug with thread local storage
Date: Sun, 27 Sep 2015 11:18:28 +0200
On Sat, Sep 26, 2015 at 06:10:05AM +0000, Matt Thomas wrote:
> I believe initial-exec is only valid for static programs, not one using
> shared libraries.
There are some limitations with dlopen/dlclose cycles, but it should
work.
Joerg
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: src
Date: Wed, 31 May 2023 00:18:44 +0000
Module Name: src
Committed By: riastradh
Date: Wed May 31 00:18:44 UTC 2023
Modified Files:
src/distrib/sets/lists/tests: mi shl.mi
src/tests/libexec/ld.elf_so: Makefile
Added Files:
src/tests/libexec/ld.elf_so: t_tls_extern.c
src/tests/libexec/ld.elf_so/helper_def_static: Makefile h_def_static.c
src/tests/libexec/ld.elf_so/helper_use_static: Makefile h_use_static.c
Log Message:
ld.elf_so: New test for extern initial-exec TLS, PR toolchain/50277.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.1264 -r1.1265 src/distrib/sets/lists/tests/mi
cvs rdiff -u -r1.11 -r1.12 src/distrib/sets/lists/tests/shl.mi
cvs rdiff -u -r1.12 -r1.13 src/tests/libexec/ld.elf_so/Makefile
cvs rdiff -u -r0 -r1.1 src/tests/libexec/ld.elf_so/t_tls_extern.c
cvs rdiff -u -r0 -r1.1 src/tests/libexec/ld.elf_so/helper_def_static/Makefile \
src/tests/libexec/ld.elf_so/helper_def_static/h_def_static.c
cvs rdiff -u -r0 -r1.1 src/tests/libexec/ld.elf_so/helper_use_static/Makefile \
src/tests/libexec/ld.elf_so/helper_use_static/h_use_static.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: src/tests/libexec/ld.elf_so
Date: Wed, 31 May 2023 00:46:11 +0000
Module Name: src
Committed By: riastradh
Date: Wed May 31 00:46:11 UTC 2023
Modified Files:
src/tests/libexec/ld.elf_so: Makefile t_tls_extern.c
src/tests/libexec/ld.elf_so/helper_use_static: Makefile h_use_static.c
Log Message:
ld.elf_so: Fix extern TLS test to match PR toolchain/50277.
Now it's actually testing the problem.
To generate a diff of this commit:
cvs rdiff -u -r1.13 -r1.14 src/tests/libexec/ld.elf_so/Makefile
cvs rdiff -u -r1.1 -r1.2 src/tests/libexec/ld.elf_so/t_tls_extern.c
cvs rdiff -u -r1.1 -r1.2 \
src/tests/libexec/ld.elf_so/helper_use_static/Makefile \
src/tests/libexec/ld.elf_so/helper_use_static/h_use_static.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: src/tests/libexec/ld.elf_so
Date: Thu, 1 Jun 2023 20:48:30 +0000
Module Name: src
Committed By: riastradh
Date: Thu Jun 1 20:48:30 UTC 2023
Modified Files:
src/tests/libexec/ld.elf_so: t_tls_extern.c
Log Message:
ld.elf_so: Test variations on PR toolchain/50277.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 src/tests/libexec/ld.elf_so/t_tls_extern.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Joerg Sonnenberger" <joerg@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: src
Date: Sun, 4 Jun 2023 01:24:59 +0000
Module Name: src
Committed By: joerg
Date: Sun Jun 4 01:24:58 UTC 2023
Modified Files:
src/libexec/ld.elf_so: README.TLS map_object.c rtld.h tls.c
src/libexec/ld.elf_so/arch/aarch64: mdreloc.c
src/libexec/ld.elf_so/arch/alpha: alpha_reloc.c
src/libexec/ld.elf_so/arch/arm: mdreloc.c
src/libexec/ld.elf_so/arch/hppa: hppa_reloc.c
src/libexec/ld.elf_so/arch/i386: mdreloc.c
src/libexec/ld.elf_so/arch/m68k: mdreloc.c
src/libexec/ld.elf_so/arch/mips: mips_reloc.c
src/libexec/ld.elf_so/arch/or1k: mdreloc.c
src/libexec/ld.elf_so/arch/powerpc: ppc_reloc.c
src/libexec/ld.elf_so/arch/riscv: mdreloc.c
src/libexec/ld.elf_so/arch/sh3: mdreloc.c
src/libexec/ld.elf_so/arch/sparc: mdreloc.c
src/libexec/ld.elf_so/arch/sparc64: mdreloc.c
src/libexec/ld.elf_so/arch/x86_64: mdreloc.c
src/tests/libexec/ld.elf_so: t_tls_extern.c
Log Message:
Fix interactions of initial-exec TLS model and dlopen
(1) If an initial-exec relocation was used for a non-local symbol
(i.e. the definition of the symbol is in a different DSO), the
computation of the static TLS offset used the wrong DSO.
This would effectively mean the wrong address was computed
(PR toolchain/50277, PR pkg/57445).
Fix this by forcing the computation of the correct DSO (the one defining
the symbol).
This code uses __UNCONST to avoid the vast interface changes for this
special case.
(2) If symbols from a DSO loaded via dlopen are used with both
global-dynamic/local-dynamic and initial-exec relocations AND
a initial-exec relocation was resolved first in a thread, a split brain
situation could exist where the dynamic relocations would use one memory
block (separate allocation) and the initial-exec relocations the static
per-thread TLS space.
(3) If the initial-exec relocation in (2) is seen after any thread has
already used a GD/LD allocation, bail out. Since IE relocations are used
only in the GOT, this will prevent the dlopen. This is a bit more
aggressive than necessary, but a full blown reference counting doesn't
seem to be justified.
To generate a diff of this commit:
cvs rdiff -u -r1.5 -r1.6 src/libexec/ld.elf_so/README.TLS
cvs rdiff -u -r1.66 -r1.67 src/libexec/ld.elf_so/map_object.c
cvs rdiff -u -r1.145 -r1.146 src/libexec/ld.elf_so/rtld.h
cvs rdiff -u -r1.17 -r1.18 src/libexec/ld.elf_so/tls.c
cvs rdiff -u -r1.17 -r1.18 src/libexec/ld.elf_so/arch/aarch64/mdreloc.c
cvs rdiff -u -r1.43 -r1.44 src/libexec/ld.elf_so/arch/alpha/alpha_reloc.c
cvs rdiff -u -r1.45 -r1.46 src/libexec/ld.elf_so/arch/arm/mdreloc.c
cvs rdiff -u -r1.49 -r1.50 src/libexec/ld.elf_so/arch/hppa/hppa_reloc.c
cvs rdiff -u -r1.41 -r1.42 src/libexec/ld.elf_so/arch/i386/mdreloc.c
cvs rdiff -u -r1.33 -r1.34 src/libexec/ld.elf_so/arch/m68k/mdreloc.c
cvs rdiff -u -r1.74 -r1.75 src/libexec/ld.elf_so/arch/mips/mips_reloc.c
cvs rdiff -u -r1.3 -r1.4 src/libexec/ld.elf_so/arch/or1k/mdreloc.c
cvs rdiff -u -r1.62 -r1.63 src/libexec/ld.elf_so/arch/powerpc/ppc_reloc.c
cvs rdiff -u -r1.8 -r1.9 src/libexec/ld.elf_so/arch/riscv/mdreloc.c
cvs rdiff -u -r1.35 -r1.36 src/libexec/ld.elf_so/arch/sh3/mdreloc.c
cvs rdiff -u -r1.56 -r1.57 src/libexec/ld.elf_so/arch/sparc/mdreloc.c
cvs rdiff -u -r1.69 -r1.70 src/libexec/ld.elf_so/arch/sparc64/mdreloc.c
cvs rdiff -u -r1.47 -r1.48 src/libexec/ld.elf_so/arch/x86_64/mdreloc.c
cvs rdiff -u -r1.11 -r1.12 src/tests/libexec/ld.elf_so/t_tls_extern.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: xsrc/external/mit
Date: Sun, 4 Jun 2023 11:36:50 +0000
Module Name: xsrc
Committed By: riastradh
Date: Sun Jun 4 11:36:50 UTC 2023
Modified Files:
xsrc/external/mit/MesaLib.old/dist/src/glx: glxcurrent.c
xsrc/external/mit/MesaLib/dist/src/glx: glxcurrent.c
Log Message:
mesa: Remove massive kludge that worked around PR toolchain/50277.
Now that the underlying bug in ld.elf_so is fixed, the workaround is
causing harm.
XXX pullup-10
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.2 -r1.2 \
xsrc/external/mit/MesaLib.old/dist/src/glx/glxcurrent.c
cvs rdiff -u -r1.3 -r1.4 xsrc/external/mit/MesaLib/dist/src/glx/glxcurrent.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sun, 04 Jun 2023 11:53:47 +0000
State-Changed-Why:
fix committed
State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Wed, 02 Aug 2023 16:00:03 +0000
State-Changed-Why:
pullup-10 #297: https://releng.netbsd.org/cgi-bin/req-10.cgi?show=297
pullup-9 #1699: https://releng.netbsd.org/cgi-bin/req-9.cgi?show=1699
(probably not worthwhile for netbsd-8 but follow up if it matters)
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: [netbsd-10] xsrc/external/mit
Date: Fri, 4 Aug 2023 14:09:25 +0000
Module Name: xsrc
Committed By: martin
Date: Fri Aug 4 14:09:25 UTC 2023
Modified Files:
xsrc/external/mit/MesaLib.old/dist/src/glx [netbsd-10]: glxcurrent.c
xsrc/external/mit/MesaLib/dist/src/glx [netbsd-10]: glxcurrent.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #308):
xsrc/external/mit/MesaLib/dist/src/glx/glxcurrent.c: revision 1.4
xsrc/external/mit/MesaLib.old/dist/src/glx/glxcurrent.c: revision 1.2
mesa: Remove massive kludge that worked around PR toolchain/50277.
Now that the underlying bug in ld.elf_so is fixed, the workaround is
causing harm.
To generate a diff of this commit:
cvs rdiff -u -r1.1.1.2 -r1.1.1.2.2.1 \
xsrc/external/mit/MesaLib.old/dist/src/glx/glxcurrent.c
cvs rdiff -u -r1.3 -r1.3.2.1 \
xsrc/external/mit/MesaLib/dist/src/glx/glxcurrent.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: [netbsd-9] xsrc/external/mit/MesaLib/dist/src/glx
Date: Fri, 4 Aug 2023 14:12:49 +0000
Module Name: xsrc
Committed By: martin
Date: Fri Aug 4 14:12:49 UTC 2023
Modified Files:
xsrc/external/mit/MesaLib/dist/src/glx [netbsd-9]: glxcurrent.c
Log Message:
Pull up following revision(s) (requested by riastradh in ticket #1704):
xsrc/external/mit/MesaLib/dist/src/glx/glxcurrent.c: revision 1.4 (patch)
mesa: Remove massive kludge that worked around PR toolchain/50277.
Now that the underlying bug in ld.elf_so is fixed, the workaround is
causing harm.
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.2.2.1 \
xsrc/external/mit/MesaLib/dist/src/glx/glxcurrent.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
State-Changed-From-To: pending-pullups->closed
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Sat, 05 Aug 2023 16:26:32 +0000
State-Changed-Why:
fixed in HEAD and pulled up to 10 and 9
(follow up if you care about this in 8)
From: "David Brownlee" <abs@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: pkgsrc/sysutils/szyszka/files
Date: Mon, 7 Aug 2023 19:37:12 +0000
Module Name: pkgsrc
Committed By: abs
Date: Mon Aug 7 19:37:12 UTC 2023
Modified Files:
pkgsrc/sysutils/szyszka/files: szyszka.sh
Log Message:
Update comment for PR#57445/50277 workaround
To generate a diff of this commit:
cvs rdiff -u -r1.2 -r1.3 pkgsrc/sysutils/szyszka/files/szyszka.sh
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "David Brownlee" <abs@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/50277 CVS commit: pkgsrc/www/firefox/files
Date: Mon, 7 Aug 2023 19:37:23 +0000
Module Name: pkgsrc
Committed By: abs
Date: Mon Aug 7 19:37:23 UTC 2023
Modified Files:
pkgsrc/www/firefox/files: firefox.sh
Log Message:
Update comment for PR#57445/50277 workaround
To generate a diff of this commit:
cvs rdiff -u -r1.3 -r1.4 pkgsrc/www/firefox/files/firefox.sh
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.47 2022/09/11 19:34:41 kim Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2023
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home