toolchain/50277: rtld relocation bug with thread local storage

[tnn%NetBSD.org@localhost]

>Number:         50277
>Category:       toolchain
>Synopsis:       rtld relocation bug with thread local storage
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    toolchain-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 26 02:40:00 +0000 2015
>Originator:     Tobias Nygren
>Release:        7.99.21
>Organization:
>Environment:
x86_64
>Description:
Here are the prerequisites to trigger the bug:

- shared library 1, which has a TLS symbol declared as extern
- shared library 2 provides the TLS symbol
- shared library 1 links with shared library 2 to get the TLS symbol
- main application dlopens shared library 1

With the above conditions satisfied the symbol will point to different addresses in each of the libraries' GOT!

>How-To-Repeat:
======= shlib1.c =======

extern __thread int mysym __attribute__((tls_model("initial-exec")));
int* func1() { return &mysym; }

======= shlib2.c =======

__thread int mysym __attribute__((tls_model("initial-exec"))) = 0;
int* func2() { return &mysym; }

======= main.c =======

#include <stdio.h>
#include <dlfcn.h>

int main(void) {
	int* (*func1)();
	int* (*func2)();
	void* handle1 = dlopen("./libshlib1.so", 0);
	void* handle2 = dlopen("./libshlib2.so", RTLD_NOLOAD);
	func1 = dlsym(handle1, "func1");
	func2 = dlsym(handle2, "func2");
	if (func1() != func2())
		printf("Should not happen! %p %p\n", func1(), func2());
}


======= build instructions =======

cc -g -fPIC -o libshlib2.so -shared shlib2.c
cc -g -fPIC -o libshlib1.so -L. -Wl,-R. -lshlib2 -shared shlib1.c
cc -g -fPIC -o main main.c

======= result =======

./main
Should not happen! 0x7f7ff7ffd0c0 0x7f7ff7ffd0bc

>Fix:
Not sure. Some kind of relocation issue. Moving the symbol from the second library to the first library seems to be a workaround.