diff options
author | H.J. Lu <hjl.tools@gmail.com> | 2023-12-20 19:42:12 -0800 |
---|---|---|
committer | H.J. Lu <hjl.tools@gmail.com> | 2023-12-23 06:42:26 -0800 |
commit | d052665f359be24623c0ca0aea8abd372cbefe90 (patch) | |
tree | 5c9044592cab950de69daa128299261aa9abcc52 /NEWS | |
parent | 8bd00f5b6d42ee89f61b5f15624788ad1aed917e (diff) | |
download | glibc-d052665f359be24623c0ca0aea8abd372cbefe90.tar.gz glibc-d052665f359be24623c0ca0aea8abd372cbefe90.tar.xz glibc-d052665f359be24623c0ca0aea8abd372cbefe90.zip |
x86-64: Fix the tcb field load for x32 [BZ #31185]
_dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic access the thread pointer via the tcb field in TCB: _dl_tlsdesc_undefweak: _CET_ENDBR movq 8(%rax), %rax subq %fs:0, %rax ret _dl_tlsdesc_dynamic: ... subq %fs:0, %rax movq -8(%rsp), %rdi ret Since the tcb field in TCB is a pointer, %fs:0 is a 32-bit location, not 64-bit. It should use "sub %fs:0, %RAX_LP" instead. Since _dl_tlsdesc_undefweak returns ptrdiff_t and _dl_make_tlsdesc_dynamic returns void *, RAX_LP is appropriate here for x32 and x86-64. This fixes BZ #31185. (cherry picked from commit 81be2a61dafc168327c1639e97b6dae128c7ccf3)
Diffstat (limited to 'NEWS')
-rw-r--r-- | NEWS | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/NEWS b/NEWS index 3634e0c8b5..81d986567e 100644 --- a/NEWS +++ b/NEWS @@ -53,6 +53,7 @@ The following bugs are resolved with this release: [30515] _dl_find_object incorrectly returns 1 during early startup [30842] Stack read overflow in getaddrinfo in no-aaaa mode (CVE-2023-4527) [31184] FAIL: elf/tst-tlsgap + [31185] Incorrect thread point access in _dl_tlsdesc_undefweak and _dl_tlsdesc_dynamic Version 2.37 |