NetBSD Problem Report #60469

From www@netbsd.org  Mon Jul 20 13:26:57 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 75A9F1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Mon, 20 Jul 2026 13:26:57 +0000 (UTC)
Message-Id: <20260720132656.4F5F11A923D@mollari.NetBSD.org>
Date: Mon, 20 Jul 2026 13:26:56 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: assertion "ALIGNED_P(q, obj->tlsalign)" failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60469
>Notify-List:    skrll, ryoon
>Category:       bin
>Synopsis:       assertion "ALIGNED_P(q, obj->tlsalign)" failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    riastradh
>State:          feedback
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 20 13:30:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sun Aug 02 13:20:03 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11
>Organization:
The NetTLS Misalignment, Inc.
>Environment:
>Description:

	With ld.elf_so built with DEBUG, thread-local storage alignment
	sometimes goes awry.

	Reported by ryoon@ on current-users:
	https://mail-index.NetBSD.org/current-users/2026/07/20/msg047745.html

>How-To-Repeat:

	$ dig txt _spf.google.com
	assertion "ALIGNED_P(q, obj->tlsalign)" failed: file "/home/riastradh/netbsd/current/src/libexec/ld.elf_so/tls.c", line 333
	[1]   Abort trap (core dumped) LD_DEBUG=1 dig txt _spf.google.com.
	$ LD_DEBUG=1 dig txt _spf.google.com
	...
	initializing Thread Local Storage for main thread
	_rtld_tls_static_space 2576
	lwp 3791 tls tcb 0x787463e63a90
	/usr/bin/dig: [lwp 3791] tls dtv 0x787463e63910-0x787463e63910 index 1 offset 180 alignment 80 tlsinit 0x847a80 BAD ALIGNMENT
	assertion "ALIGNED_P(q, obj->tlsalign)" failed: file "/home/riastradh/netbsd/current/src/libexec/ld.elf_so/tls.c", line 333
	[1]   Abort trap (core dumped) LD_DEBUG=1 dig txt _spf.google.com.

	(Note: `alignment 80' is in hexadecimal.)

>Fix:

	Yes, please!

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: bin-bug-people->riastradh
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Mon, 20 Jul 2026 14:42:46 +0000
Responsible-Changed-Why:
take


State-Changed-From-To: open->feedback
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Mon, 20 Jul 2026 18:48:15 +0000
State-Changed-Why:
ryoon: Does this fix your crash?


From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60469 CVS commit: src/libexec/ld.elf_so
Date: Mon, 20 Jul 2026 18:46:37 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Mon Jul 20 18:46:37 UTC 2026

 Modified Files:
 	src/libexec/ld.elf_so: tls.c xmalloc.c

 Log Message:
 ld.elf_so: Fix static TLS alignment on variant II platforms.

 Only affects obscure architectures like x86, though.

 Sprinkle assertions to make sure this breaks in other ways on other
 architectures too, like variant I, or variant II with _lwp_gettcb().
 Fair's fair, right?

 XXX We should consider verifying that every Elf_Phdr::p_align is
 reasonable (i.e., is a power of two, or is zero but only if p_memsz
 is also zero), and that p_filesz <= p_memsz, in headers.c for the
 main object and in map_object.c for other objects.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333


 To generate a diff of this commit:
 cvs rdiff -u -r1.29 -r1.30 src/libexec/ld.elf_so/tls.c
 cvs rdiff -u -r1.27 -r1.28 src/libexec/ld.elf_so/xmalloc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60469 CVS commit: src/libexec/ld.elf_so
Date: Mon, 20 Jul 2026 22:42:01 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Mon Jul 20 22:42:01 UTC 2026

 Modified Files:
 	src/libexec/ld.elf_so: tls.c

 Log Message:
 ld.elf_so: Mark new variables __debugused, not __diagused.

 They are used in ld.elf_so builds with DEBUG, not with DIAGNOSTIC!

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333


 To generate a diff of this commit:
 cvs rdiff -u -r1.30 -r1.31 src/libexec/ld.elf_so/tls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60469 CVS commit: [netbsd-11] src/libexec/ld.elf_so
Date: Wed, 22 Jul 2026 05:22:33 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Wed Jul 22 05:22:32 UTC 2026

 Modified Files:
 	src/libexec/ld.elf_so [netbsd-11]: search.c tls.c xmalloc.c

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #393):

 	libexec/ld.elf_so/search.c: revision 1.30
 	libexec/ld.elf_so/xmalloc.c: revision 1.28
 	libexec/ld.elf_so/tls.c: revision 1.30
 	libexec/ld.elf_so/tls.c: revision 1.31
 	libexec/ld.elf_so/search.c: revision 1.29

 ld.elf_so: Fix assertion: obj may be NULL _or_ OBJ_ERR (-1) here
 NULL means the object wasn't found and we should keep searching;
 OBJ_ERR means the object was found but loading it failed and we
 should stop.  Only if the object is _neither_ NULL _nor_ OBJ_ERR is
 it expected to be an object with positive refcount.

 Followup for
 PR lib/59751: dlclose is not MT-safe depending on the libraries
 unloaded

 ld.elf_so: Fix static TLS alignment on variant II platforms.

 Only affects obscure architectures like x86, though.
 Sprinkle assertions to make sure this breaks in other ways on other
 architectures too, like variant I, or variant II with _lwp_gettcb().

 Fair's fair, right?

 XXX We should consider verifying that every Elf_Phdr::p_align is
 reasonable (i.e., is a power of two, or is zero but only if p_memsz
 is also zero), and that p_filesz <= p_memsz, in headers.c for the
 main object and in map_object.c for other objects.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333

 ld.elf_so: Mark new variables __debugused, not __diagused.

 They are used in ld.elf_so builds with DEBUG, not with DIAGNOSTIC!

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333

 ld.elf_so: Fix one more mistake in handling _rtld_load_object.

 This can return NULL (meaning object not found or something went wrong
 with the object) or OBJ_ERR (meaning the object has DF_1_NOOPEN set or
 the caller passed RTLD_NOLOAD to dlopen() and the object was not
 already loaded) or a valid object.

 I reviewed all paths out of _rtld_load_object to make sure they
 gracefully handle all three cases (NULL, OBJ_ERR, valid object), and
 this assertion was the only path that didn't.

 Fixes buggy assertion added for:
 PR lib/59751: dlclose is not MT-safe depending on the libraries
 unloaded

 May fix:
 PR bin/60472: ld.elf_so(1) changes cause a segmentation fault in
 dlopen(3)


 To generate a diff of this commit:
 cvs rdiff -u -r1.27.10.1 -r1.27.10.2 src/libexec/ld.elf_so/search.c
 cvs rdiff -u -r1.23.2.2 -r1.23.2.3 src/libexec/ld.elf_so/tls.c
 cvs rdiff -u -r1.12.44.3 -r1.12.44.4 src/libexec/ld.elf_so/xmalloc.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: Martin Husemann <martin@duskware.de>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: bin/60469: assertion "ALIGNED_P(offset, obj->tlsalign)" failed
Date: Wed, 22 Jul 2026 11:05:14 +0200

 With yesterdays -current on evbearmv7hf-eb:

 > gdb dig
 Reading symbols from dig...
 Reading symbols from /usr/libdata/debug/usr/bin/dig.debug...
 (gdb) run localhost
 Starting program: /usr/bin/dig localhost
 assertion "ALIGNED_P(offset, obj->tlsalign)" failed: file "/work/src/libexec/ld.elf_so/tls.c", line 549

 Program received signal SIGABRT, Aborted.
 0x7afeb2f8 in _lwp_kill () from /usr/libexec/ld.elf_so
 (gdb) bt
 #0  0x7afeb2f8 in _lwp_kill () from /usr/libexec/ld.elf_so
 #1  0x7afeb124 in abort () at /work/src/lib/libc/stdlib/abort.c:74
 #2  0x7afe9ac8 in xassert (file=<optimized out>, line=line@entry=549, 
     failedexpr=<optimized out>) at /work/src/libexec/ld.elf_so/xprintf.c:321
 #3  0x7afe8b84 in _rtld_tls_offset_allocate (obj=obj@entry=0x6de6f000)
     at /work/src/libexec/ld.elf_so/tls.c:549
 #4  0x7afe42d4 in _rtld (sp=<optimized out>, relocbase=<optimized out>)
     at /work/src/libexec/ld.elf_so/rtld.c:1144
 #5  0x7afda514 in _rtld_start () from /usr/libexec/ld.elf_so
 #3  0x7afe8b84 in _rtld_tls_offset_allocate (obj=obj@entry=0x6de6f000)
     at /work/src/libexec/ld.elf_so/tls.c:549
 warning: 549    /work/src/libexec/ld.elf_so/tls.c: No such file or directory
 (gdb) p offset
 $1 = <optimized out>
 (gdb) p _rtld_tls_static_offset
 $2 = 8
 (gdb) p obj->tlsalign
 $3 = 64
 (gdb) p obj->tlssize 
 $4 = 164
 (gdb) p next_offset
 $5 = 2063535276
 (gdb) p/x next_offset
 $6 = 0x7aff0cac

 Martin

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60469 CVS commit: src/libexec/ld.elf_so
Date: Wed, 22 Jul 2026 15:22:24 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Jul 22 15:22:24 UTC 2026

 Modified Files:
 	src/libexec/ld.elf_so: tls.c

 Log Message:
 ld.elf_so: Fix assertions for TLS variant I without _lwp_settcb.

 In variant I, the TLS address is always

 	(uint8_t *)tcb + sizeof(struct tls_tcb) + obj->tlsoffset.

 With _lwp_settcb, (uint8_t *)tcb + sizeof(struct tls_tcb) is aligned,
 whereas without it, (uint8_t *)tcb is aligned.  Consequently, with
 _lwp_settcb, obj->tlsoffset must also be aligned, whereas without it,
 obj->tlsoffset + sizeof(struct tls_tcb) must be aligned -- and hence,
 without _lwp_settcb, obj->tlsoffset must be congruent to
 -sizeof(struct tls_tcb) modulo the alignment.

 No functional change intended for non-DEBUG builds: assertion changes
 only here.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333


 To generate a diff of this commit:
 cvs rdiff -u -r1.31 -r1.32 src/libexec/ld.elf_so/tls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60469 CVS commit: src/libexec/ld.elf_so
Date: Wed, 22 Jul 2026 15:22:48 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Jul 22 15:22:48 UTC 2026

 Modified Files:
 	src/libexec/ld.elf_so: tls.c

 Log Message:
 ld.elf_so: Sprinkle assertions in _rtld_tls_module_allocate.

 No functional change intended for non-DEBUG builds: assertion changes
 only here.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333


 To generate a diff of this commit:
 cvs rdiff -u -r1.32 -r1.33 src/libexec/ld.elf_so/tls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60469 CVS commit: src/libexec/ld.elf_so
Date: Wed, 22 Jul 2026 15:23:33 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Wed Jul 22 15:23:33 UTC 2026

 Modified Files:
 	src/libexec/ld.elf_so: tls.c

 Log Message:
 ld.elf_so: Prune some dead TLS variant branches.

 __lwp_settcb / __lwp_gettcb_fast are used only with TLS variant I,
 never with TLS variant II.

 So say `#ifdef __HAVE_TLS_VARIANT_II' instead of `#ifndef
 __HAVE_TLS_VARIANT_I' to make it clearer, and prune all the
 __HAVE___LWP_SETTCB / __HAVE___LWP_GETTCB_FAST branches under it
 because they're unreachable.

 No functional change intended: all the deleted code should be dead.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333


 To generate a diff of this commit:
 cvs rdiff -u -r1.33 -r1.34 src/libexec/ld.elf_so/tls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60469 CVS commit: [netbsd-11] src/libexec/ld.elf_so
Date: Sun, 2 Aug 2026 13:19:34 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Sun Aug  2 13:19:34 UTC 2026

 Modified Files:
 	src/libexec/ld.elf_so [netbsd-11]: tls.c

 Log Message:
 Pull up following revision(s) (requested by riastradh in ticket #395):

 	libexec/ld.elf_so/tls.c: revision 1.32
 	libexec/ld.elf_so/tls.c: revision 1.33
 	libexec/ld.elf_so/tls.c: revision 1.34

 ld.elf_so: Fix assertions for TLS variant I without _lwp_settcb.

 In variant I, the TLS address is always

         (uint8_t *)tcb + sizeof(struct tls_tcb) + obj->tlsoffset.

 With _lwp_settcb, (uint8_t *)tcb + sizeof(struct tls_tcb) is aligned,
 whereas without it, (uint8_t *)tcb is aligned.  Consequently, with
 _lwp_settcb, obj->tlsoffset must also be aligned, whereas without it,
 obj->tlsoffset + sizeof(struct tls_tcb) must be aligned -- and hence,
 without _lwp_settcb, obj->tlsoffset must be congruent to
 -sizeof(struct tls_tcb) modulo the alignment.

 No functional change intended for non-DEBUG builds: assertion changes
 only here.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333

 ld.elf_so: Sprinkle assertions in _rtld_tls_module_allocate.

 No functional change intended for non-DEBUG builds: assertion changes
 only here.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333

 ld.elf_so: Prune some dead TLS variant branches.
 __lwp_settcb / __lwp_gettcb_fast are used only with TLS variant I,
 never with TLS variant II.

 So say `#ifdef __HAVE_TLS_VARIANT_II' instead of `#ifndef
 __HAVE_TLS_VARIANT_I' to make it clearer, and prune all the
 __HAVE___LWP_SETTCB / __HAVE___LWP_GETTCB_FAST branches under it
 because they're unreachable.

 No functional change intended: all the deleted code should be dead.

 PR bin/60469: bin/60469: assertion "ALIGNED_P(q, obj->tlsalign)"
 failed: file "/usr/src/libexec/ld.elf_so/tls.c", line 333


 To generate a diff of this commit:
 cvs rdiff -u -r1.23.2.3 -r1.23.2.4 src/libexec/ld.elf_so/tls.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search