https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104862
Bug ID: 104862
Summary: extern thread_local (emutls) code crashes with ASLR on
Windows
Product: gcc
Version: 11.2.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: c++
Assignee: unassigned at gcc dot gnu.org
Reporter: alvinhochun at gmail dot com
CC: martin at martin dot st
Target Milestone: ---
Test code:
/// static_test.cpp
#include <iostream>
thread_local int s1;
extern thread_local int s2;
void dummy(void *a) {
// no-op
}
void __attribute__ ((noinline)) a(int v) {
s1 = v;
dummy(&v);
s2 = v + 1;
}
int __attribute__ ((noinline)) b() {
return s1 + s2;
}
int main() {
int n;
std::cin >> n;
a(n);
std::cout << b();
return 0;
}
/// static_obj.cpp
thread_local int s2;
/// ----------
Compiled with mingw-builds mingw-w64 gcc
x86_64-11.2.0-release-posix-seh-rt_v9-rev1 [1]:
g++ -Og -g -std=gnu++17 -c static_obj.cpp -o static_obj.o
g++ -Og -g -std=gnu++17 static_test.cpp static_obj.o -o static_test.exe
Running it segfaults:
(gdb) r
Starting program: D:\temp\static_test.exe
[New Thread 5368.0x4568]
[New Thread 5368.0x5598]
[New Thread 5368.0x4aec]
1 # <-- user input
Thread 1 received signal SIGSEGV, Segmentation fault.
0x00007ff663890000 in ?? ()
(gdb) disas a
Dump of assembler code for function _Z1ai:
0x00007ff6a3891587 <+0>: push %rbx
0x00007ff6a3891588 <+1>: sub $0x20,%rsp
0x00007ff6a389158c <+5>: mov %ecx,%ebx
0x00007ff6a389158e <+7>: lea 0x1a8b(%rip),%rcx #
0x7ff6a3893020 <__emutls_v.s1>
0x00007ff6a3891595 <+14>: call 0x7ff6a3892730 <__emutls_get_address>
0x00007ff6a389159a <+19>: mov %ebx,(%rax)
0x00007ff6a389159c <+21>: add $0x1,%ebx
0x00007ff6a389159f <+24>: lea -0x400015a6(%rip),%rax #
0x7ff663890000
0x00007ff6a38915a6 <+31>: test %rax,%rax
0x00007ff6a38915a9 <+34>: je 0x7ff6a38915b0 <_Z1ai+41>
0x00007ff6a38915ab <+36>: call 0x7ff663890000
0x00007ff6a38915b0 <+41>: mov 0x2d99(%rip),%rcx #
0x7ff6a3894350 <.refptr.__emutls_v.s2>
0x00007ff6a38915b7 <+48>: call 0x7ff6a3892730 <__emutls_get_address>
0x00007ff6a38915bc <+53>: mov %ebx,(%rax)
0x00007ff6a38915be <+55>: add $0x20,%rsp
0x00007ff6a38915c2 <+59>: pop %rbx
0x00007ff6a38915c3 <+60>: ret
End of assembler dump.
Note the assembler from +24 to +36.
The generated assembler (corresponding to +24 ~ +53):
leaq _ZTH2s2(%rip), %rax
testq %rax, %rax
je .L7
call _ZTH2s2
.L7:
movq .refptr.__emutls_v.s2(%rip), %rcx
call __emutls_get_address
movl %ebx, (%rax)
It looks like the symbol _ZTH2s2 is the "thread-local initialization routine
for s2" (which is declared weak) and ends up being null, which is what
`-0x400015a6(%rip)` is supposed to point to. But due to ASLR this address ends
up being offset and causing the jump to not be taken and then calling an
invalid address.
Clang uses `cmpq $0, .refptr._ZTH2s2(%rip)` for this which doesn't have the
same problem.
(Many thanks to Martin Storsjö for helping me on this.)
[1]:
https://github.com/niXman/mingw-builds-binaries/releases/tag/11.2.0-rt_v9-rev1
