Don't use broken DL_AUTO_FUNCTION_ADDRESS()

On hppa and ia64, the macro DL_AUTO_FUNCTION_ADDRESS() uses the
variable fptr[2] in it's own scope.

The content of fptr[] is thus undefined right after the macro exits.
Newer gcc's (>= 4.7) reuse the stack space of this variable triggering
a segmentation fault in dl-init.c:69.

To fix this we rewrite the macros to make the call directly to init
and fini without needing to pass back a constructed function pointer.

URL: https://bugs.gentoo.org/486618
URL: https://bugs.gentoo.org/486974

(cherry picked from commit daf75146de07303ea0c5ad700ec5ef703ec114a1)

8 files changed, 71 insertions, 61 deletions

diff --git a/elf/dl-close.c b/elf/dl-close.c
index fe3014cca3..407926bade 100644
--- a/elf/dl-close.c
+++ b/elf/dl-close.c
@@ -274,9 +274,8 @@ _dl_close_worker (struct link_map *map)
 
 	      /* Next try the old-style destructor.  */
 	      if (imap->l_info[DT_FINI] != NULL)
-		(*(void (*) (void)) DL_DT_FINI_ADDRESS
-		 (imap, ((void *) imap->l_addr
-			 + imap->l_info[DT_FINI]->d_un.d_ptr))) ();
+		DL_CALL_DT_FINI (imap, ((void *) imap->l_addr
+			 + imap->l_info[DT_FINI]->d_un.d_ptr));
 	    }
 
 #ifdef SHARED
diff --git a/elf/dl-fini.c b/elf/dl-fini.c
index 6b245f0022..db5269c82f 100644
--- a/elf/dl-fini.c
+++ b/elf/dl-fini.c
@@ -254,7 +254,7 @@ _dl_fini (void)
 
 		  /* Next try the old-style destructor.  */
 		  if (l->l_info[DT_FINI] != NULL)
-		    ((fini_t) DL_DT_FINI_ADDRESS (l, l->l_addr + l->l_info[DT_FINI]->d_un.d_ptr)) ();
+		     DL_CALL_DT_FINI(l, l->l_addr + l->l_info[DT_FINI]->d_un.d_ptr);
 		}
 
 #ifdef SHARED
diff --git a/elf/dl-init.c b/elf/dl-init.c
index a657eb6c40..40783684f2 100644
--- a/elf/dl-init.c
+++ b/elf/dl-init.c
@@ -61,13 +61,7 @@ call_init (struct link_map *l, int argc, char **argv, char **env)
      - the others in the DT_INIT_ARRAY.
   */
   if (l->l_info[DT_INIT] != NULL)
-    {
-      init_t init = (init_t) DL_DT_INIT_ADDRESS
-	(l, l->l_addr + l->l_info[DT_INIT]->d_un.d_ptr);
-
-      /* Call the function.  */
-      init (argc, argv, env);
-    }
+    DL_CALL_DT_INIT(l, l->l_addr + l->l_info[DT_INIT]->d_un.d_ptr, argc, argv, env);
 
   /* Next see whether there is an array with initialization functions.  */
   ElfW(Dyn) *init_array = l->l_info[DT_INIT_ARRAY];
diff --git a/ports/sysdeps/hppa/dl-lookupcfg.h b/ports/sysdeps/hppa/dl-lookupcfg.h
index 5c84c4367a..feea320789 100644
--- a/ports/sysdeps/hppa/dl-lookupcfg.h
+++ b/ports/sysdeps/hppa/dl-lookupcfg.h
@@ -38,32 +38,36 @@ void _dl_unmap (struct link_map *map);
 
 #define DL_UNMAP(map) _dl_unmap (map)
 
-#define DL_AUTO_FUNCTION_ADDRESS(map, addr)				\
-({									\
-  unsigned int fptr[2];							\
-  fptr[0] = (unsigned int) (addr);					\
-  fptr[1] = (map)->l_info[DT_PLTGOT]->d_un.d_ptr;			\
-  /* Set bit 30 to indicate to $$dyncall that this is a PLABEL. */	\
-  (ElfW(Addr))((unsigned int)fptr | 2);					\
-})
-
-#define DL_STATIC_FUNCTION_ADDRESS(map, addr)				\
-({									\
-  static unsigned int fptr[2];						\
-  fptr[0] = (unsigned int) (addr);					\
-  fptr[1] = (map)->l_info[DT_PLTGOT]->d_un.d_ptr;			\
-  /* Set bit 30 to indicate to $$dyncall that this is a PLABEL. */	\
-  (ElfW(Addr))((unsigned int)fptr | 2);					\
-})
-
-
-/* The test for "addr & 2" below is to accomodate old binaries which
-   violated the ELF ABI by pointing DT_INIT and DT_FINI at a function
-   descriptor.  */
-#define DL_DT_INIT_ADDRESS(map, addr) \
-  ((Elf32_Addr)(addr) & 2 ? (addr) : DL_AUTO_FUNCTION_ADDRESS (map, addr))
-#define DL_DT_FINI_ADDRESS(map, addr) \
-  ((Elf32_Addr)(addr) & 2 ? (addr) : DL_AUTO_FUNCTION_ADDRESS (map, addr))
+#define DL_DT_FUNCTION_ADDRESS(map, start, attr, addr)			\
+  attr volatile unsigned int fptr[2];					\
+ /* The test for "start & 2" below is to accommodate old binaries which	\
+    violated the ELF ABI by pointing DT_INIT and DT_FINI at a function	\
+    descriptor.  */							\
+  if ((ElfW(Addr)) (start) & 2)						\
+    addr = (ElfW(Addr)) start;						\
+  else									\
+    {									\
+      fptr[0] = (unsigned int) (start);					\
+      fptr[1] = (map)->l_info[DT_PLTGOT]->d_un.d_ptr;			\
+      /* Set bit 30 to indicate to $$dyncall that this is a PLABEL. */	\
+      addr = (ElfW(Addr))((unsigned int)fptr | 2);			\
+    }									\
+
+#define DL_CALL_DT_INIT(map, start, argc, argv, env)	\
+{							\
+  ElfW(Addr) addr;					\
+  DL_DT_FUNCTION_ADDRESS(map, start, , addr)		\
+  init_t init = (init_t) addr; 				\
+  init (argc, argv, env);				\
+}
+
+#define DL_CALL_DT_FINI(map, start)		\
+{						\
+  ElfW(Addr) addr;				\
+  DL_DT_FUNCTION_ADDRESS(map, start, , addr)	\
+  fini_t fini = (fini_t) addr;			\
+  fini ();					\
+}
 
 /* The type of the return value of fixup/profile_fixup */
 #define DL_FIXUP_VALUE_TYPE struct fdesc
diff --git a/ports/sysdeps/hppa/dl-machine.h b/ports/sysdeps/hppa/dl-machine.h
index d2411a654a..e47e9473e1 100644
--- a/ports/sysdeps/hppa/dl-machine.h
+++ b/ports/sysdeps/hppa/dl-machine.h
@@ -490,8 +490,12 @@ asm (									\
 #define ELF_MACHINE_NO_REL 1
 
 /* Return the address of the entry point. */
-#define ELF_MACHINE_START_ADDRESS(map, start) \
-  DL_STATIC_FUNCTION_ADDRESS (map, start)
+#define ELF_MACHINE_START_ADDRESS(map, start)			\
+({								\
+	ElfW(Addr) addr;					\
+	DL_DT_FUNCTION_ADDRESS(map, start, static, addr)	\
+	addr;							\
+})
 
 /* We define an initialization functions.  This is called very early in
  *    _dl_sysdep_start.  */
diff --git a/ports/sysdeps/ia64/dl-lookupcfg.h b/ports/sysdeps/ia64/dl-lookupcfg.h
index 4da12635c8..cfaa2520b3 100644
--- a/ports/sysdeps/ia64/dl-lookupcfg.h
+++ b/ports/sysdeps/ia64/dl-lookupcfg.h
@@ -39,24 +39,28 @@ extern void _dl_unmap (struct link_map *map);
 
 #define DL_UNMAP(map) _dl_unmap (map)
 
-#define DL_AUTO_FUNCTION_ADDRESS(map, addr)		\
-({							\
-  unsigned long int fptr[2];				\
-  fptr[0] = (unsigned long int) (addr);			\
-  fptr[1] = (map)->l_info[DT_PLTGOT]->d_un.d_ptr;	\
-  (Elf64_Addr) fptr;					\
-})
-
-#define DL_STATIC_FUNCTION_ADDRESS(map, addr)		\
-({							\
-  static unsigned long int fptr[2];			\
-  fptr[0] = (unsigned long int) (addr);			\
-  fptr[1] = (map)->l_info[DT_PLTGOT]->d_un.d_ptr;	\
-  (Elf64_Addr) fptr;					\
-})
-
-#define DL_DT_INIT_ADDRESS(map, addr) DL_AUTO_FUNCTION_ADDRESS (map, addr)
-#define DL_DT_FINI_ADDRESS(map, addr) DL_AUTO_FUNCTION_ADDRESS (map, addr)
+#define DL_DT_FUNCTION_ADDRESS(map, start, attr, addr)			\
+  attr volatile unsigned long int fptr[2];					\
+  fptr[0] = (unsigned long int) (start);					\
+  fptr[1] = (map)->l_info[DT_PLTGOT]->d_un.d_ptr;			\
+  addr = (ElfW(Addr)) fptr;						\
+
+#define DL_CALL_DT_INIT(map, start, argc, argv, env)	\
+{							\
+  ElfW(Addr) addr;					\
+  DL_DT_FUNCTION_ADDRESS(map, start, , addr)		\
+  init_t init = (init_t) addr; 				\
+  init (argc, argv, env);				\
+}
+
+#define DL_CALL_DT_FINI(map, start)		\
+{						\
+  ElfW(Addr) addr;				\
+  DL_DT_FUNCTION_ADDRESS(map, start, , addr)	\
+  fini_t fini = (fini_t) addr;			\
+  fini ();					\
+}
+
 /* The type of the return value of fixup/profile_fixup.  */
 #define DL_FIXUP_VALUE_TYPE struct fdesc
 /* Construct a value of type DL_FIXUP_VALUE_TYPE from a code address
diff --git a/ports/sysdeps/ia64/dl-machine.h b/ports/sysdeps/ia64/dl-machine.h
index dd469d7a73..61236378fe 100644
--- a/ports/sysdeps/ia64/dl-machine.h
+++ b/ports/sysdeps/ia64/dl-machine.h
@@ -322,8 +322,12 @@ elf_machine_runtime_setup (struct link_map *l, int lazy, int profile)
 #define ELF_MACHINE_NO_REL 1
 
 /* Return the address of the entry point. */
-#define ELF_MACHINE_START_ADDRESS(map, start)	\
-  DL_STATIC_FUNCTION_ADDRESS (map, start)
+#define ELF_MACHINE_START_ADDRESS(map, start)			\
+({								\
+	ElfW(Addr) addr;					\
+	DL_DT_FUNCTION_ADDRESS(map, start, static, addr)	\
+	addr;							\
+})
 
 /* Fixup a PLT entry to bounce directly to the function at VALUE.  */
 static inline struct fdesc __attribute__ ((always_inline))
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index e7b0516aaf..146aca4dfb 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -76,8 +76,9 @@ typedef struct link_map *lookup_t;
 # define DL_SYMBOL_ADDRESS(map, ref) \
  (void *) (LOOKUP_VALUE_ADDRESS (map) + ref->st_value)
 # define DL_LOOKUP_ADDRESS(addr) ((ElfW(Addr)) (addr))
-# define DL_DT_INIT_ADDRESS(map, start) (start)
-# define DL_DT_FINI_ADDRESS(map, start) (start)
+# define DL_CALL_DT_INIT(map, start, argc, argv, env) \
+ ((init_t) (start)) (argc, argv, env)
+# define DL_CALL_DT_FINI(map, start) ((fini_t) (start)) ()
 #endif
 
 /* On some architectures dladdr can't use st_size of all symbols this way.  */