Print this page
10471 ld(1) amd64 LD->LE TLS transition causes memory corruption

Split Close
Expand all
Collapse all
          --- old/usr/src/cmd/sgs/libld/common/machrel.amd.c
          +++ new/usr/src/cmd/sgs/libld/common/machrel.amd.c
↓ open down ↓ 732 lines elided ↑ open up ↑
 733  733                   * LD->LE
 734  734                   *
 735  735                   * Transition:
 736  736                   *      0x00 leaq x1@dtpoff(%rax), %rcx
 737  737                   * To:
 738  738                   *      0x00 leaq x1@tpoff(%rax), %rcx
 739  739                   */
 740  740                  DBG_CALL(Dbg_reloc_transition(ofl->ofl_lml, M_MACH,
 741  741                      R_AMD64_TPOFF32, arsp, ld_reloc_sym_name));
 742  742                  arsp->rel_rtype = R_AMD64_TPOFF32;
 743      -                arsp->rel_raddend = 0;
 744  743                  return (FIX_RELOC);
 745  744          }
 746  745  
 747  746          return (FIX_RELOC);
 748  747  }
 749  748  
 750  749  static uintptr_t
 751  750  ld_do_activerelocs(Ofl_desc *ofl)
 752  751  {
 753  752          Rel_desc        *arsp;
↓ open down ↓ 3 lines elided ↑ open up ↑
 757  756          ofl_flag_t      flags = ofl->ofl_flags;
 758  757  
 759  758          if (aplist_nitems(ofl->ofl_actrels.rc_list) != 0)
 760  759                  DBG_CALL(Dbg_reloc_doact_title(ofl->ofl_lml));
 761  760  
 762  761          /*
 763  762           * Process active relocations.
 764  763           */
 765  764          REL_CACHE_TRAVERSE(&ofl->ofl_actrels, idx, rcbp, arsp) {
 766  765                  uchar_t         *addr;
 767      -                Xword           value;
      766 +                Xword           value;
 768  767                  Sym_desc        *sdp;
 769  768                  const char      *ifl_name;
 770  769                  Xword           refaddr;
 771  770                  int             moved = 0;
 772  771                  Gotref          gref;
 773  772                  Os_desc         *osp;
 774  773  
 775  774                  /*
 776  775                   * If the section this relocation is against has been discarded
 777  776                   * (-zignore), then discard (skip) the relocation itself.
↓ open down ↓ 934 lines elided ↑ open up ↑
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX