Bug 227204

Summary: Failing on its effectivity - kernel VDSO randomization
Product: [Fedora] Fedora Reporter: Jan Kratochvil <jan.kratochvil>
Component: prelinkAssignee: Jakub Jelinek <jakub>
Severity: medium Docs Contact:
Priority: medium    
Version: rawhideCC: davej, k3dzngrp8w2xtc9, mingo, roland, triage
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Linux   
Whiteboard: bzcl34nup
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-05-07 01:07:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Jan Kratochvil 2007-02-03 14:35:57 UTC
Description of problem:
As kernel randomizes its small "[vdso]" mapping it sometimes maps it to the
place where glibc is prelinked, needing a regular glibc relocation to a
different place upon its loading.

Version-Release number of selected component (if applicable):

How reproducible:
Reliably, in ~20% of cases.

Steps to Reproduce:
1. yum install prelink
2. /etc/cron.daily/prelink
3. LD_DEBUG=statistics cat /proc/self/maps |grep
'00c52000.*/lib/i686/nosegneg/libc-2.5.90.so' # address of the prelinked glibc

Actual results:
[ Only in 20% of cases, in 80% of cases it is as in the "Expected results". ]
$ LD_DEBUG=statistics cat /proc/self/maps |grep
     19816:     runtime linker statistics:
     19816:       total startup time in dynamic loader: 3138178 clock cycles
     19816:                 time needed for relocation: 460991 clock cycles (14.6%)
     19816:                      number of relocations: 99
     19816:           number of relocations from cache: 5
     19816:             number of relative relocations: 1240
     19816:                time needed to load objects: 1325265 clock cycles (42.2%)

Expected results:
$ LD_DEBUG=statistics cat /proc/self/maps |grep
     19811:     runtime linker statistics:
     19811:       total startup time in dynamic loader: 1356025 clock cycles
     19811:                 time needed for relocation: 50154 clock cycles (3.6%)
     19811:                      number of relocations: 0
     19811:           number of relocations from cache: 17
     19811:             number of relative relocations: 0
     19811:                time needed to load objects: 625825 clock cycles (46.1%)
00c52000-00da0000 r-xp 00000000 03:05 4186805    /lib/i686/nosegneg/libc-2.5.90.so

Additional info:
#define SHLIB_BASE             0x00110000
        if (!addr && !(flags & MAP_FIXED))
                addr = randomize_range(SHLIB_BASE, 0x01000000, len);

VDSO mapping should have its mapped range reduced/adjusted in cooperation with
#define REG0S   0x00101000
#define REG0E   0x00e00000

[ I did not check the non-i686 platforms. ]

Comment 3 Bug Zapper 2008-04-03 19:00:44 UTC
Based on the date this bug was created, it appears to have been reported
against rawhide during the development of a Fedora release that is no
longer maintained. In order to refocus our efforts as a project we are
flagging all of the open bugs for releases which are no longer
maintained. If this bug remains in NEEDINFO thirty (30) days from now,
we will automatically close it.

If you can reproduce this bug in a maintained Fedora version (7, 8, or
rawhide), please change this bug to the respective version and change
the status to ASSIGNED. (If you're unable to change the bug's version
or status, add a comment to the bug and someone will change it for you.)

Thanks for your help, and we apologize again that we haven't handled
these issues to this point.

The process we're following is outlined here:

We will be following the process here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping to ensure this
doesn't happen again.

Comment 4 Bug Zapper 2008-05-07 01:07:45 UTC
This bug has been in NEEDINFO for more than 30 days since feedback was
first requested. As a result we are closing it.

If you can reproduce this bug in the future against a maintained Fedora
version please feel free to reopen it against that version.

The process we're following is outlined here: