Bug 201026 - rtld-elf reaches divide-by-zero in symlook_obj on 11.0-CURRENT
Summary: rtld-elf reaches divide-by-zero in symlook_obj on 11.0-CURRENT
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: sparc64 Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-06-21 22:31 UTC by gmbroome
Modified: 2015-06-22 12:01 UTC (History)
1 user (show)

See Also:


Attachments
Arguments passed to symlook_obj (3.03 KB, text/plain)
2015-06-21 22:31 UTC, gmbroome
no flags Details
The culprit binary of x11-fonts/libfontenc (32.12 KB, application/octet-stream)
2015-06-21 22:32 UTC, gmbroome
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description gmbroome 2015-06-21 22:31:01 UTC
Created attachment 157958 [details]
Arguments passed to symlook_obj

Offending line in libexec/rtld-elf/rtld.c:
4143		bucket = obj->buckets_gnu[req->hash_gnu % obj->nbuckets_gnu];

As we're doing a modulo, there seems to be an assumption that obj->nbuckets_gnu is non-zero by the time that we get here.  I've run into at least one case where it is zero, triggering a SIGFPE.

Running on world and kernel from SVN (r284174) on 11.0-CURRENT sparc64.  Model is a Blade 2000 using 2 x USIIICu 1.2GHz.  Kernel, world, and indeed entire stack of ports in this case were built with completely empty make.conf; no -O flags or such.

The div-by-zero on the above mentioned line is triggered (at least) any time that Xorg attempts to load /usr/local/lib/libfontenc.so.1 from x11-fonts/libfontenc.

Expected results: Xorg displays the launched application
Actual results: Xorg exits with a SIGFPE

N.B. Utilizing libfontenc.so.1 in my own 'dummy' test application results in the same signal, suggesting that this is a linker issue (or possibly a fontenc issue) rather than an Xorg one; Xorg was just first the manifestation here.

Backtrace:
#0  0x00000000403cc9d8 in symlook_obj (req=0x7fdffffe920, obj=0x403f1c00) at rtld.c:4143
#1  0x00000000403ccb28 in symlook_list (req=0x7fdffffea20, objlist=<value optimized out>, dlp=0x7fdffffec70) at rtld.c:3860
#2  0x00000000403ccd80 in symlook_global (req=0x7fdffffed40, donelist=0x7fdffffec70) at rtld.c:3758
#3  0x00000000403cd204 in symlook_default (req=0x7fdffffed40, refobj=0x403e7000) at rtld.c:3811
#4  0x00000000403cd4a8 in find_symdef (symnum=26, refobj=0x403e7000, defobj_out=0x7fdffffee78, flags=1, cache=0x0, lockstate=0x7fdffffee40) at rtld.c:1592
#5  0x00000000403cdb1c in _rtld_bind (obj=0x403e7000, reloff=1872) at rtld.c:713
#6  0x00000000403c60a0 in _rtld_bind_start_1 () at /usr/src/libexec/rtld-elf/sparc64/rtld_start.S:166


Attached items: "obj" and "req", as passed to symlook_obj, and my binary of libfontenc.so.1
Comment 1 gmbroome 2015-06-21 22:32:52 UTC
Created attachment 157959 [details]
The culprit binary of x11-fonts/libfontenc
Comment 2 gmbroome 2015-06-22 12:01:57 UTC
Relinking libfontenc with newer GNU ld from devel/binutils fixes this behavior