From c59c50b5bf277b22974c2114c22ce9ea852750fb Mon Sep 17 00:00:00 2001 From: zqz Date: Thu, 10 Sep 2026 10:06:15 +0800 Subject: [PATCH] KZT, fix: Align x86-64 JUMP_SLOT relocation with glibc glibc ignores the RELA addend for R_X86_64_JUMP_SLOT and writes the resolved symbol value directly to the relocation slot. previously added r_addend during immediate binding. A nonzero addend could therefore shift a KZT bridge address to an invalid entry point, as observed for realloc in guest libc. Write the resolved symbol address without the addend, matching glibc and LATX's existing lazy resolver. Signed-off-by: zqz --- target/i386/latx/context/elfloader.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/target/i386/latx/context/elfloader.c b/target/i386/latx/context/elfloader.c index eaccd25919..56f885ae6c 100755 --- a/target/i386/latx/context/elfloader.c +++ b/target/i386/latx/context/elfloader.c @@ -986,10 +986,10 @@ static int relocate_elf_rela( ) { if (offs){ if(p) { - printf_log(LOG_INFO, "RelocateElfRELA : Apply %s R_X86_64_JUMP_SLOT @%p with sym=%s (%p -> %p)\n", (bind==STB_LOCAL)?"Local":"Global", p, symname, *(void**)p, (void*)(offs+rela[i].r_addend)); + printf_log(LOG_INFO, "RelocateElfRELA : Apply %s R_X86_64_JUMP_SLOT @%p with sym=%s (%p -> %p)\n", (bind==STB_LOCAL)?"Local":"Global", p, symname, *(void**)p, (void*)offs); if (kzt_relocation_store( transaction, (uintptr_t *)p, - offs + rela[i].r_addend) != 0) { + offs) != 0) { printf_log(LOG_INFO, "Cannot write R_X86_64_JUMP_SLOT @%p\n", p);