segfault in ld-linux-x86-64.so - linux

Question

My manually built elf x64 file has started crashing on load, within the last three months or so.
It worked fine (and has done for about 10 years or so) on Ubuntu 20.04.x, but fails on 22.04 - same problem on Mint 19.3 and Fedora 36 and MX-linux MX21.
dmesg output:
[ 107.121214] p[4370]: segfault at 0 ip 00007f3d725b8350 sp 00007ffea111fba0 error 4
in ld-linux-x86-64.so.2[7f3d72598000+2a000]
[ 107.121230] Code: ff ff 00 45 31 db 48 8d 15 c9 ac 00 00 4c 8d 05 46 8f 01 00 4c 8d
2d 1f 8f 01 00 49 89 c2 48 8d 58 ff 48 89 f8 49 f7 da 66 90 <8b>
08 83 f9 07 77 19 85 c9 74 45 83 f9 07 77 40 48 63 0c 8a 48 01
You can download the offending file (a single plain 4MB ELF x64) from http://phix.x10.mx/p64 and I've included a detailed textual dump of all the headers below (but not the data or text sections).
It almost certainly contains older/rarer forms of relocations and suchlike, but
only ten of them and meant to be as simple as possible. One thing it does not have is all the messy got/plt stuff.
If I need to change the binary content of that file, I can, but might need a wee bit of help. (a "fake" got/plt maybe?)
Of course, if/once it gets through ld-linux-x86-64.so and complains about something else, ignore it, or should you be at all intrigued you can visit http://phix.x10.mx/download.php to get the full package.
References, just in case you need them, or to ask a wider set than just me for more details direct:
https://bugs.launchpad.net/ubuntu/+source/ld.so.preload-manager/+bug/1992468 (Oct 11th)
https://openeuphoria.org/forum/136972.wc?last_id=136973
https://github.com/petelomax/Phix/issues/13
The following is the first 1,276 bytes of the file from my own filedump program (the first 253 of 552,132 lines in total).
ELF Header
==========
00000000,ei_magic,x4,0x7F&&"ELF",ELF signature
00000004,ei_class,1,2,64 bit
00000005,ei_data,1,1,little endian
00000006,ei_version,1,1,current
00000007,ei_osabi,1,0,System V
00000008,ei_abiversion,1,0,
00000009,ei_pad,h6,000000000000h,
0000000F,ei_size,h1,00h,
00000010,e_type,2,2,Executable file
00000012,e_machine,2,62,x86-64
00000014,e_version,4,1,current
00000018,e_entry,h8, 674000h,
00000020,e_phoff,h8, 40h,program header table
00000028,e_shoff,h8, 0h,section header table
00000030,e_flags,h4,00000000h,
00000034,e_ehsize,h2,0040h,ELF header size
00000036,e_phentsize,2,56,program header table entry size
00000038,e_phnum,2,5,number of program header entries
0000003A,e_shentsize,2,64,section header entry size
0000003C,e_shnum,2,0,number of section header entries
0000003E,e_shstrndx,2,0,section name string table index
Program Headers
===============
00000040,p_type,4,3,PT_INTERP
00000044,p_flags,h4,00000004h,Read
00000048,p_offset,h8, 158h,file offset
00000050,p_vaddr,h8, 400158h,virtual address (see "Interpreter" tab)
00000058,p_paddr,h8, 400158h,physical addressing(ignored)
00000060,p_filesz,h8, 20h,bytes in file image
00000068,p_memsz,h8, 20h,bytes in memory image
00000070,p_align,h8, 1000h,
,-,,,
00000078,p_type,4,2,PT_DYNAMIC
0000007C,p_flags,h4,00000004h,Read
00000080,p_offset,h8, 178h,file offset
00000088,p_vaddr,h8, 400178h,virtual address (see "Dynamic Link Info" tab)
00000090,p_paddr,h8, 400178h,physical addressing(ignored)
00000098,p_filesz,h8, B0h,bytes in file image
000000A0,p_memsz,h8, B0h,bytes in memory image
000000A8,p_align,h8, 1000h,
,-,,,
000000B0,p_type,4,1,PT_LOAD
000000B4,p_flags,h4,00000006h,Read+Write
000000B8,p_offset,h8, 228h,file offset
000000C0,p_vaddr,h8, 400228h,virtual address (see "Symtab" tab)
000000C8,p_paddr,h8, 400228h,physical addressing(ignored)
000000D0,p_filesz,h8, 2D8h,bytes in file image
000000D8,p_memsz,h8, 2D8h,bytes in memory image
000000E0,p_align,h8, 1000h,
,-,,,
000000E8,p_type,4,1,PT_LOAD
000000EC,p_flags,h4,00000006h,Read+Write
000000F0,p_offset,h8, 500h,file offset
000000F8,p_vaddr,h8, 400500h,virtual address (see "Data Segment" tab)
00000100,p_paddr,h8, 400500h,physical addressing(ignored)
00000108,p_filesz,h8, 273B00h,bytes in file image
00000110,p_memsz,h8, 273B00h,bytes in memory image
00000118,p_align,h8, 1000h,
,-,,,
00000120,p_type,4,1,PT_LOAD
00000124,p_flags,h4,00000005h,Read+Execute
00000128,p_offset,h8, 274000h,file offset
00000130,p_vaddr,h8, 674000h,virtual address (see "Code Segment" tab)
00000138,p_paddr,h8, 674000h,physical addressing(ignored)
00000140,p_filesz,h8, 1C1734h,bytes in file image
00000148,p_memsz,h8, 1C1734h,bytes in memory image
00000150,p_align,h8, 1000h,
,-,,,
Interpreter
===========
00000158,00400158,-,2F6C6962 36342F6C ,/lib64/l
00000160,00400160,-,642D6C69 6E75782D 7838362D 36342E73 ,d-linux-x86-64.s
00000170,00400170,-,6F2E3200 00000000 ,o.2.....
Dynamic Link Info
=================
00000178,d_tag,h8, 1h,DT_NEEDED
00000180,d_val,8,1,libc.so.6
00000188,d_tag,h8, 1h,DT_NEEDED
00000190,d_val,8,62,libdl.so.2
00000198,d_tag,h8, 6h,DT_SYMTAB
000001A0,d_ptr,h8, 400228h,(See "Symtab" tab)
000001A8,d_tag,h8, Bh,DT_SYMENT
000001B0,d_val,8,16, (- size of one symtab entry)
000001B8,d_tag,h8, 4h,DT_HASH
000001C0,d_ptr,h8, 400330h,(See "Symtab" tab, Hash)
000001C8,d_tag,h8, 5h,DT_STRTAB
000001D0,d_ptr,h8, 400368h,(See "Symtab" tab, Strings)
000001D8,d_tag,h8, Ah,DT_STRSZ
000001E0,d_val,8,88, (- strings end at #000003BF)
000001E8,d_tag,h8, 7h,DT_RELA
000001F0,d_ptr,h8, 4003C0h,(See "Symtab" tab, Relocationas)
000001F8,d_tag,h8, 8h,DT_RELASZ
00000200,d_val,8,240, (- total DT_RELA table size)
00000208,d_tag,h8, 9h,DT_RELAENT
00000210,d_val,8,24, (- size of one DT_RELA entry)
00000218,d_tag,h8, 0h,DT_NULL
00000220,d_tag,h8, 0h,DT_NULL
Symtab
======
,--Symtab--,,,
00000228,st_name[0],h4,00000000h,DT_SYMTAB [#00400228]
0000022C,st_info,h1,00h,
0000022D,st_other,h1,00h,(should be 0)
0000022E,st_shndx,h2,0000h,
00000230,st_value,h8, 0h,
00000238,st_size,8,0,
,-,,,
00000240,st_name[1],h4,0000000Bh,mmap
00000244,st_info,h1,12h,STB_GLOBAL, STT_FUNC
00000245,st_other,h1,00h,(should be 0)
00000246,st_shndx,h2,0000h,
00000248,st_value,h8, 0h,
00000250,st_size,8,0,
,-,,,
00000258,st_name[2],h4,00000010h,getenv
0000025C,st_info,h1,12h,STB_GLOBAL, STT_FUNC
0000025D,st_other,h1,00h,(should be 0)
0000025E,st_shndx,h2,0000h,
00000260,st_value,h8, 0h,
00000268,st_size,8,0,
,-,,,
00000270,st_name[3],h4,00000017h,unsetenv
00000274,st_info,h1,12h,STB_GLOBAL, STT_FUNC
00000275,st_other,h1,00h,(should be 0)
00000276,st_shndx,h2,0000h,
00000278,st_value,h8, 0h,
00000280,st_size,8,0,
,-,,,
00000288,st_name[4],h4,00000020h,setenv
0000028C,st_info,h1,12h,STB_GLOBAL, STT_FUNC
0000028D,st_other,h1,00h,(should be 0)
0000028E,st_shndx,h2,0000h,
00000290,st_value,h8, 0h,
00000298,st_size,8,0,
,-,,,
000002A0,st_name[5],h4,00000027h,close
000002A4,st_info,h1,12h,STB_GLOBAL, STT_FUNC
000002A5,st_other,h1,00h,(should be 0)
000002A6,st_shndx,h2,0000h,
000002A8,st_value,h8, 0h,
000002B0,st_size,8,0,
,-,,,
000002B8,st_name[6],h4,0000002Dh,dup2
000002BC,st_info,h1,12h,STB_GLOBAL, STT_FUNC
000002BD,st_other,h1,00h,(should be 0)
000002BE,st_shndx,h2,0000h,
000002C0,st_value,h8, 0h,
000002C8,st_size,8,0,
,-,,,
000002D0,st_name[7],h4,00000032h,fork
000002D4,st_info,h1,12h,STB_GLOBAL, STT_FUNC
000002D5,st_other,h1,00h,(should be 0)
000002D6,st_shndx,h2,0000h,
000002D8,st_value,h8, 0h,
000002E0,st_size,8,0,
,-,,,
000002E8,st_name[8],h4,00000037h,system
000002EC,st_info,h1,12h,STB_GLOBAL, STT_FUNC
000002ED,st_other,h1,00h,(should be 0)
000002EE,st_shndx,h2,0000h,
000002F0,st_value,h8, 0h,
000002F8,st_size,8,0,
,-,,,
00000300,st_name[9],h4,00000049h,dlopen
00000304,st_info,h1,12h,STB_GLOBAL, STT_FUNC
00000305,st_other,h1,00h,(should be 0)
00000306,st_shndx,h2,0000h,
00000308,st_value,h8, 0h,
00000310,st_size,8,0,
,-,,,
00000318,st_name[10],h4,00000050h,dlsym
0000031C,st_info,h1,12h,STB_GLOBAL, STT_FUNC
0000031D,st_other,h1,00h,(should be 0)
0000031E,st_shndx,h2,0000h,
00000320,st_value,h8, 0h,
00000328,st_size,8,0,
,-,,,
,--Hash--,,,
00000330,nbucket,4,1,DT_HASH [#00400330]
00000334,nchain,4,11,(also defines DT_SYMTAB size)
00000338,bucket[0],4,0,
0000033C,chain[0],4,1,
00000340,chain[1],4,2,
00000344,chain[2],4,3,
00000348,chain[3],4,4,
0000034C,chain[4],4,5,
00000350,chain[5],4,6,
00000354,chain[6],4,7,
00000358,chain[7],4,8,
0000035C,chain[8],4,9,
00000360,chain[9],4,10,
00000364,chain[10],4,0,
,-,,,
,--Strings--,,,
00000368,00000000,-,00,.
00000369,00000001,-,6C6962632E736F2E3600,libc.so.6.
00000373,0000000B,-,6D6D617000,mmap.
00000378,00000010,-,676574656E7600,getenv.
0000037F,00000017,-,756E736574656E7600,unsetenv.
00000388,00000020,-,736574656E7600,setenv.
0000038F,00000027,-,636C6F736500,close.
00000395,0000002D,-,6475703200,dup2.
0000039A,00000032,-,666F726B00,fork.
0000039F,00000037,-,73797374656D00,system.
000003A6,0000003E,-,6C6962646C2E736F2E3200,libdl.so.2.
000003B1,00000049,-,646C6F70656E00,dlopen.
000003B8,00000050,-,646C73796D000000,dlsym...
,-,,,
,--Relocationas--,,,
000003C0,r_offset,h8, 4004B0h,DT_RELA [#004003C0]
000003C8,r_info,h8, 100000001h,R_X86_64_64, symtab[1]=mmap
000003D0,r_addend,h8, 0h,
000003D8,r_offset,h8, 4004B8h,
000003E0,r_info,h8, 200000001h,R_X86_64_64, symtab[2]=getenv
000003E8,r_addend,h8, 0h,
000003F0,r_offset,h8, 4004C0h,
000003F8,r_info,h8, 300000001h,R_X86_64_64, symtab[3]=unsetenv
00000400,r_addend,h8, 0h,
00000408,r_offset,h8, 4004C8h,
00000410,r_info,h8, 400000001h,R_X86_64_64, symtab[4]=setenv
00000418,r_addend,h8, 0h,
00000420,r_offset,h8, 4004D0h,
00000428,r_info,h8, 500000001h,R_X86_64_64, symtab[5]=close
00000430,r_addend,h8, 0h,
00000438,r_offset,h8, 4004D8h,
00000440,r_info,h8, 600000001h,R_X86_64_64, symtab[6]=dup2
00000448,r_addend,h8, 0h,
00000450,r_offset,h8, 4004E0h,
00000458,r_info,h8, 700000001h,R_X86_64_64, symtab[7]=fork
00000460,r_addend,h8, 0h,
00000468,r_offset,h8, 4004E8h,
00000470,r_info,h8, 800000001h,R_X86_64_64, symtab[8]=system
00000478,r_addend,h8, 0h,
00000480,r_offset,h8, 4004F0h,
00000488,r_info,h8, 900000001h,R_X86_64_64, symtab[9]=dlopen
00000490,r_addend,h8, 0h,
00000498,r_offset,h8, 4004F8h,
000004A0,r_info,h8, A00000001h,R_X86_64_64, symtab[10]=dlsym
000004A8,r_addend,h8, 0h,
,-,,,
,--relocs--,,,
000004B0,reloc[1] (#004004B0),-,00000000 00000000 ,........
000004B8,reloc[2] (#004004B8),-,00000000 00000000 ,........
000004C0,reloc[3] (#004004C0),-,00000000 00000000 ,........
000004C8,reloc[4] (#004004C8),-,00000000 00000000 ,........
000004D0,reloc[5] (#004004D0),-,00000000 00000000 ,........
000004D8,reloc[6] (#004004D8),-,00000000 00000000 ,........
000004E0,reloc[7] (#004004E0),-,00000000 00000000 ,........
000004E8,reloc[8] (#004004E8),-,00000000 00000000 ,........
000004F0,reloc[9] (#004004F0),-,00000000 00000000 ,........
000004F8,reloc[10] (#004004F8),-,00000000 00000000 ,........
Update (after four months of getting nowhere): on a new mint 21 cinnamon 64bit vm:
pete#pete-VirtualBox:~/phix$ ./p64
Segmentation fault (core dumped)
pete#pete-VirtualBox:~/phix$ /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 ./p64
Phix hybrid interpreter/compiler.
Version 1.0.2 (64 bit Linux) Copyright Pete Lomax 2006..2022
Enter ? for options or filename to execute:-test
which completes fine...
Though not entirely surprisingly, "-c -test" segfaults on the first one...

Answer 1

Finally got it. It seems simply that p_align is now more strictly applied (fair enough, I guess).