Re: unaligned access using bash on glibc 2.5

On 5/1/07, John David Anglin <[email protected]> wrote:
> The two least significant bits in ip contain the priviledge level
> of the executing code.  They have to be masked off to get the address
> of a faulting instruction.

You'll be pleasantly suprised to know we tracked this down to a
missing save/restore of the PIC register on a library call.

  0x40bcb744 <closedir+44>:       copy r20,r22
  0x40bcb748 <closedir+48>:       b,l 0x40bb4aa0,rp
  0x40bcb74c <closedir+52>:       copy r3,r26

See this lonely b,l without a PIC register save/restore? That's the
problem. It's a jump to a stub, which calls free, but free tailcalls
into __internal_free, and the PIC register isn't restored by free or
by closedir.

FWIW I see this aswell when compiling glibc with gcc mainline:

  10:   6b d3 3f c1     stw r19,-20(sp)
../sysdeps/unix/closedir.c:52
  14:   e8 40 00 00     b,l 1c <__closedir+0x1c>,rp
                        14: R_PARISC_PCREL17F   free
  18:   0c a0 10 85     ldw 0(r5),r5
../sysdeps/unix/closedir.c:54
  1c:   08 05 02 5a     copy r5,r26
  20:   08 13 02 44     copy r19,r4

Why isn't there a save/restore of the PIC register around the call to
free? Clearly r19 is being used, notice the save/restore starting on
"20:".

Cheers,
Carlos.