Print this page
10471 ld(1) amd64 LD->LE TLS transition causes memory corruption


 723                  *      0x03 movq %fs:0, %rax
 724                  */
 725                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 726                     R_AMD64_NONE, arsp, ld_reloc_sym_name));
 727                 offset -= 3;
 728                 (void) memcpy(offset, tlsinstr_ld_le, sizeof (tlsinstr_ld_le));
 729                 return (FIX_DONE);
 730 
 731         case R_AMD64_DTPOFF32:
 732                 /*
 733                  * LD->LE
 734                  *
 735                  * Transition:
 736                  *      0x00 leaq x1@dtpoff(%rax), %rcx
 737                  * To:
 738                  *      0x00 leaq x1@tpoff(%rax), %rcx
 739                  */
 740                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 741                     R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
 742                 arsp->rel_rtype = R_AMD64_TPOFF32;
 743                 arsp->rel_raddend = 0;
 744                 return (FIX_RELOC);
 745         }
 746 
 747         return (FIX_RELOC);
 748 }
 749 
 750 static uintptr_t
 751 ld_do_activerelocs(Ofl_desc *ofl)
 752 {
 753         Rel_desc        *arsp;
 754         Rel_cachebuf    *rcbp;
 755         Aliste          idx;
 756         uintptr_t       return_code = 1;
 757         ofl_flag_t      flags = ofl->ofl_flags;
 758 
 759         if (aplist_nitems(ofl->ofl_actrels.rc_list) != 0)
 760                 DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
 761 
 762         /*
 763          * Process active relocations.




 723                  *      0x03 movq %fs:0, %rax
 724                  */
 725                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 726                     R_AMD64_NONE, arsp, ld_reloc_sym_name));
 727                 offset -= 3;
 728                 (void) memcpy(offset, tlsinstr_ld_le, sizeof (tlsinstr_ld_le));
 729                 return (FIX_DONE);
 730 
 731         case R_AMD64_DTPOFF32:
 732                 /*
 733                  * LD->LE
 734                  *
 735                  * Transition:
 736                  *      0x00 leaq x1@dtpoff(%rax), %rcx
 737                  * To:
 738                  *      0x00 leaq x1@tpoff(%rax), %rcx
 739                  */
 740                 DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 741                     R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
 742                 arsp->rel_rtype = R_AMD64_TPOFF32;

 743                 return (FIX_RELOC);
 744         }
 745 
 746         return (FIX_RELOC);
 747 }
 748 
 749 static uintptr_t
 750 ld_do_activerelocs(Ofl_desc *ofl)
 751 {
 752         Rel_desc        *arsp;
 753         Rel_cachebuf    *rcbp;
 754         Aliste          idx;
 755         uintptr_t       return_code = 1;
 756         ofl_flag_t      flags = ofl->ofl_flags;
 757 
 758         if (aplist_nitems(ofl->ofl_actrels.rc_list) != 0)
 759                 DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
 760 
 761         /*
 762          * Process active relocations.