mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Wake Liu <wakel@google.com>
To: Shuah Khan <shuah@kernel.org>, linux-kselftest@vger.kernel.org
Cc: Tim Bird <tim.bird@sony.com>,
	Siddhesh Poyarekar <siddhesh@gotplt.org>,
	linux-kernel@vger.kernel.org,  Wake Liu <wakel@google.com>
Subject: [PATCH] selftests/size: Fix SIGSEGV on 32-bit x86 due to uninitialized vDSO pointer
Date: Tue, 29 Sep 2026 04:36:37 +0000	[thread overview]
Message-ID: <20260929043637.1917707-1-wakel@google.com> (raw)

Commit 6b64a650f0b2 ("kselftest: Minimise dependency of get_size on C
library interfaces") replaced direct C library calls with syscall() to
avoid accessing uninitialized TLS on x86_64 when built with
-nostartfiles.

However, on 32-bit x86 (i386), the C library's syscall() wrapper itself
relies on CRT startup initialization to dispatch system calls via the
vDSO entry point:
- In glibc (libc.a), syscall() executes "call *%gs:0x10", reading the
  __kernel_vsyscall pointer from the Thread Control Block (TCB).
- In Android Bionic (libc.a), syscall() calls __kernel_syscall(), which
  returns the global __libc_sysinfo pointer in .bss.

Because get_size is compiled with -static -ffreestanding -nostartfiles
and defines its own _start, CRT and TLS initialization never run. As a
result, calling libc's syscall() on 32-bit x86 dereferences an
uninitialized %gs selector or jumps to NULL (0x0), crashing immediately
with SIGSEGV.

Provide a local syscall() implementation on __i386__ that invokes
"int $0x80" directly, avoiding the C library's syscall() wrapper and
its CRT initialization dependency.

Fixes: 6b64a650f0b2 ("kselftest: Minimise dependency of get_size on C library interfaces")
Signed-off-by: Wake Liu <wakel@google.com>
---
 tools/testing/selftests/size/get_size.c | 29 +++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/tools/testing/selftests/size/get_size.c b/tools/testing/selftests/size/get_size.c
index 2980b1a63366..352c90d5c770 100644
--- a/tools/testing/selftests/size/get_size.c
+++ b/tools/testing/selftests/size/get_size.c
@@ -32,6 +32,35 @@
 
 #define STDOUT_FILENO 1
 
+#ifdef __i386__
+#include <stdarg.h>
+
+/*
+ * On 32-bit x86, libc's syscall() wrapper invokes the vDSO entry point
+ * stored in TLS (%gs:0x10 in glibc) or a global variable (__libc_sysinfo
+ * in Bionic) initialized by CRT startup routines. Because this binary is
+ * built with -nostartfiles, those pointers remain uninitialized and
+ * calling libc's syscall() crashes with SIGSEGV. Use int $0x80 directly.
+ */
+long syscall(long num, ...)
+{
+	va_list ap;
+	long a1, a2, a3, ret;
+
+	va_start(ap, num);
+	a1 = va_arg(ap, long);
+	a2 = va_arg(ap, long);
+	a3 = va_arg(ap, long);
+	va_end(ap);
+
+	__asm__ volatile("int $0x80"
+		: "=a"(ret)
+		: "a"(num), "b"(a1), "c"(a2), "d"(a3)
+		: "memory", "cc");
+	return ret;
+}
+#endif
+
 static int print(const char *s)
 {
 	size_t len = 0;
-- 
2.56.0.rc1.315.gc6ed9934b7-goog


                 reply	other threads:[~2026-09-29  4:36 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260929043637.1917707-1-wakel@google.com \
    --to=wakel@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=shuah@kernel.org \
    --cc=siddhesh@gotplt.org \
    --cc=tim.bird@sony.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®