From 1e25112dc0cb2515d27d8d178b1ecce778a9d37a Mon Sep 17 00:00:00 2001 From: Adhemerval Zanella Date: Mon, 5 Feb 2024 16:10:24 +0000 Subject: [PATCH] arm: Remove wrong ldr from _dl_start_user (BZ 31339) The commit 49d877a80b29d3002887b084eec6676d9f5fec18 (arm: Remove _dl_skip_args usage) removed the _SKIP_ARGS literal, which was previously loader to r4 on loader _start. However, the cleanup did not remove the following 'ldr r4, [sl, r4]' on _dl_start_user, used to check to skip the arguments after ld self-relocations. In my testing, the kernel initially set r4 to 0, which makes the ldr instruction just read the _GLOBAL_OFFSET_TABLE_. However, since r4 is a callee-saved register; a different runtime might not zero initialize it and thus trigger an invalid memory access. Checked on arm-linux-gnu. Reported-by: Adrian Ratiu Reviewed-by: Szabolcs Nagy --- sysdeps/arm/dl-machine.h | 1 - 1 file changed, 1 deletion(-) diff --git a/sysdeps/arm/dl-machine.h b/sysdeps/arm/dl-machine.h index b857bbc868..dd1a0f6b6e 100644 --- a/sysdeps/arm/dl-machine.h +++ b/sysdeps/arm/dl-machine.h @@ -139,7 +139,6 @@ _start:\n\ _dl_start_user:\n\ adr r6, .L_GET_GOT\n\ add sl, sl, r6\n\ - ldr r4, [sl, r4]\n\ @ save the entry point in another register\n\ mov r6, r0\n\ @ get the original arg count\n\