• binNMU of old library packages to fix global _gp symbol

    From James Cowgill@21:1/5 to All on Fri Jul 14 16:40:01 2017
    This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --JGFI3tBM5D4AcJQ22m1Cwgq1OdKL0d8nO
    Content-Type: text/plain; charset=utf-8
    Content-Language: en-US
    Content-Transfer-Encoding: quoted-printable

    Hi,

    I'm about to do lots of binNMUs on mips and mipsel which I thought I
    should tell people about :)

    Recently freepascal was bootstrapped and uploaded for mips and mipsel,
    but unfortunately some of pascal packages don't build on mips. One of
    the errors looks like this:
    /usr/bin/ld.bfd: /usr/lib/fpc/3.0.2/units/mips-linux/rtl/cprt0.o: undefined reference to symbol '_gp'
    //usr/lib/mips-linux-gnu/libXau.so.6: error adding symbols: DSO missing from command line

    After some investigation, it looks like libXau.so.6 incorrectly exports
    the _gp symbol in its dynamic symbol table. This is bad because in the
    MIPS ABI this is a special symbol which always refers to the value of
    the gp register for the _current_ executable / object. In this case the
    _gp value exported from libXau conflicted with the correct value in the
    MIPS linker script which confuses ld.

    It looks like this is a very old bug which was fixed back in 2012 by
    making the _gp symbol hidden. https://sourceware.org/ml/binutils/2012-08/msg00064.html

    This was fixed early in the binutils 2.24 cycle so I think that any
    library built with binutils << 2.23.52.20130522-1 (the first 2.24
    snapshot uploaded) could be affected. This was uploaded in May 2013.

    Note that the effects of this bug do not occur in the vast majority of executables because recent versions of GCC calculate the value of the gp register using __gnu_local_gp instead of _gp. This symbol is implemented internally by the linker so is not affected.

    I have done a scan of the archive for libraries which export _gp
    globally and these are the broken source packages to be binNMUed.
    According to buildd.debian.org, all were last built before June 2013:

    attal
    blacs-pvm
    cdparanoia
    coinor-dylp
    coinor-vol
    dia-newcanvas
    distorm64
    esound
    fsplib
    hawknl
    hepmc
    itsol
    jthread
    libart-lgpl
    libb64
    libcgic
    libcue
    libdssialsacompat
    libdvbcsa
    libexif-gtk
    libfixposix
    libg15
    libgssglue
    libinnodb
    libitl
    libloki
    libmad
    liboglappth
    libomxalsa
    libomxcamera
    libomxfbdevsink
    libomxmad
    libomxvideosrc
    libomxvorbis
    libprintsys
    librcd
    libreplaygain
    libresample
    libshout
    libsoil
    libspctag
    libvformat
    libxau
    libxmltok
    libxss
    log4c
    lua-cjson
    lwipv6
    m17n-im-config
    madlib
    mini18n
    mm
    oscpack
    qtexengine
    qwt5
    qxmlrpc
    raul
    rtfilter
    snmpkit
    sparskit
    togl
    unicap
    xaw3d
    xdffileio
    ygl

    Additionally, I also found some recent packages which incorrectly export
    _gp globally. The common factor here is that they all use the GOLD
    linker so there's probably a different bug affecting that as well.

    qt3d-opensource-src
    qtbase-opensource-src
    qtcharts-opensource-src
    qtconnectivity-opensource-src
    qtdeclarative-opensource-src
    qtlocation-opensource-src
    qtmultimedia-opensource-src
    qtquickcontrols2-opensource-src
    qtscript-opensource-src
    qtsensors-opensource-src
    qtserialport-opensource-src
    qtsvg-opensource-src
    qttools-opensource-src
    qtwayland-opensource-src
    qtwebchannel-opensource-src
    qtwebkit-opensource-src
    qtwebsockets-opensource-src
    qtx11extras-opensource-src
    qtxmlpatterns-opensource-src
    webkit2gtk

    Thanks,
    James


    --JGFI3tBM5D4AcJQ22m1Cwgq1OdKL0d8nO--

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEE+Ixt5DaZ6POztUwQx/FnbeotAe8FAlloyXMACgkQx/Fnbeot Ae9D3Q//aI+I4aFxJ3kULIMCSm9VDEp9KigVqCsAqE8pATG2Q5Xz15j9vyVQWx0x i0WDE6/5PJebgzati9rzqon25bpyWl8hDBE4RrvJo8XXKFCkxdlB2ju8XgV2lFh+ Uky6hVRndqCCxC59Xmkpx+3/Zc/F+hL2OqTGqzLmMumsefRDGosje1wmcSKC6muW XDc9R8drWps+8DLT8+qQc6+MjpckRcbPoM3Pmj7M0oeaN0uyzN6B6vO+/cr5bVXW 3MbYkmBsGs5kB9J9neINqpnaMBKTZO5aEhTnfno8JvQP00L59EmZitoMzitS9dtH Og1mASUk7lb+MLWnlEN40VTp6d391N8jtlrqG31dn6kErQAB3PZZ+Xpaw6S8vugo CqZJF4/S4v2IDA8lm1WwtsE0AEIfb2ccAyR+/jTGrYJQSaCL13KBzBpxEVaAIA2B YEt0GAJ01NPZU5Niwc/un1tuTFRwFFKRl2xlM4UudcEzAuVrqt2rIwmzQB7/dsbX OfXXqFl5W/a2Hule2nmfC0w0L9lfFWyaGYPMJqnXtsWOeMpvq3dn1G/mVfIc6owg mbVY08OEofj0SJmaKVJyoU9SyFMktKGbfxklKhk/D+Qj1bLygCw6PQ9z2o/NUVSP EvHnNVRKk90nb+awBVrovrGLAFqemN78GOGN3+I9tzB3NUG8HUs=
    =mPOL
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)