On Mon, Oct 15, 2012 at 05:07:10PM +0100, Catalin Marinas wrote:

On Sun, Oct 14, 2012 at 08:56:11PM +0100, Al Viro wrote:

quoted

On Sun, Oct 14, 2012 at 08:24:03PM +0100, Al Viro wrote:

quoted

Russell, could you recall what those had been about?  I'm not sure if that
had been oopsable that far back (again, oops scenario is userland stack
page getting swapped out before we get to start_thread(), leading to
direct read from an absent page in start_thread() by plain ldr, without
anything in exception table about that insn), but it looks very odd
regardless of that problem.

BTW, arm64 has copied that logics, so it also seems to be unsafe and very
odd - there we definitely have only ELF to cope with.  arm64 folks Cc'd...

Good point. We don't need this on arm64 and probably neither on arm (at
least since EABI).

Setting x0 may cause other issues as well. The dynamic loader simply
ignores the startup registers but for static binaries the _start code in
glibc expects r0 to contain a function pointer to be registered with
atexit() in __libc_start_main() or NULL. Since we pass argc in there,
for static binaries the rtld_fini argument to __libc_start_main() is
neither NULL nor something meaningful.

The value left there by start_thread() will not reach the userland anyway...