Android Q Beta - Wrong Bionic TLS alignment (golang)

Syncthing crashes on Pixel 3 XL after upgrading to Android Q Beta

App Version: 1.1.0.3
Syncthing Version: v1.1.0
Android Version: Android Q
Device manufacturer: Google
Device model: Pixel XL 3

--------- beginning of crash
03-15 11:39:37.094 F/libc    (11681): error: "/data/app/com.github.catfriend1.syncthingandroid-3mY72xEAJsVHsCVYH8zyLA==/lib/arm64/libsyncthing.so": executable's TLS segment is underaligned: alignment is 8, needs to be at least 64 for ARM64 Bionic
03-15 11:39:37.094 F/libc    (11681): Fatal signal 6 (SIGABRT), code -1 (SI_QUEUE) in tid 11681 (libsyncthing.so), pid 11681 (libsyncthing.so)
03-15 11:39:37.123 F/DEBUG   (11688): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-15 11:39:37.123 F/DEBUG   (11688): Build fingerprint: 'google/crosshatch/crosshatch:Q/QPP1.190205.018.B4/5347935:user/release-keys'
03-15 11:39:37.123 F/DEBUG   (11688): Revision: 'MP1.0'
03-15 11:39:37.123 F/DEBUG   (11688): ABI: 'arm64'
03-15 11:39:37.124 F/DEBUG   (11688): Timestamp: 2019-03-15 11:39:37+0300
03-15 11:39:37.124 F/DEBUG   (11688): pid: 11681, tid: 11681, name: libsyncthing.so  >>> /data/app/com.github.catfriend1.syncthingandroid-3mY72xEAJsVHsCVYH8zyLA==/lib/arm64/libsyncthing.so <<<
03-15 11:39:37.124 F/DEBUG   (11688): signal 6 (SIGABRT), code -1 (SI_QUEUE), fault addr --------
03-15 11:39:37.124 F/DEBUG   (11688): Abort message: 'error: "/data/app/com.github.catfriend1.syncthingandroid-3mY72xEAJsVHsCVYH8zyLA==/lib/arm64/libsyncthing.so": executable's TLS segment is underaligned: alignment is 8, needs to be at least 64 for ARM64 Bionic'
03-15 11:39:37.124 F/DEBUG   (11688):     x0  0000000000000000  x1  0000000000002da1  x2  0000000000000006  x3  0000007ffc3a9a40
03-15 11:39:37.124 F/DEBUG   (11688):     x4  8000000000808080  x5  8000000000808080  x6  8000000000808080  x7  0000000000000008
03-15 11:39:37.124 F/DEBUG   (11688):     x8  00000000000000f0  x9  0000007ec8b69580  x10 0000000000000000  x11 0000000000000001
03-15 11:39:37.124 F/DEBUG   (11688):     x12 0000000000000000  x13 0000000000000018  x14 000000009cff6f6d  x15 000562907ab80995
03-15 11:39:37.124 F/DEBUG   (11688):     x16 000000000001191c  x17 0000000000000000  x18 0000007ec8b40000  x19 00000000000000ac
03-15 11:39:37.124 F/DEBUG   (11688):     x20 0000000000002da1  x21 00000000000000b2  x22 0000000000002da1  x23 00000000ffffffff
03-15 11:39:37.124 F/DEBUG   (11688):     x24 0000007ec8b52000  x25 0000007ec8c665a0  x26 0000007ec8c66990  x27 0000007ec8c66000
03-15 11:39:37.124 F/DEBUG   (11688):     x28 0000007ec8c66000  x29 0000007ffc3a9af0
03-15 11:39:37.124 F/DEBUG   (11688):     sp  0000007ffc3a9a20  lr  0000007ec8c31910  pc  0000007ec8c31940
03-15 11:39:37.129 F/DEBUG   (11688): 
03-15 11:39:37.129 F/DEBUG   (11688): backtrace:
03-15 11:39:37.129 F/DEBUG   (11688):       #00 pc 00000000000dd940  /bionic/bin/linker64 (__dl_abort+176)
03-15 11:39:37.129 F/DEBUG   (11688):       #01 pc 00000000000fe47c  /bionic/bin/linker64 (__dl__ZN15StaticTlsLayout27reserve_exe_segment_and_tcbEPK10TlsSegmentPKc+276)
03-15 11:39:37.129 F/DEBUG   (11688):       #02 pc 00000000000504b4  /bionic/bin/linker64 (__dl__Z27linker_setup_exe_static_tlsPKc+68)
03-15 11:39:37.129 F/DEBUG   (11688):       #03 pc 000000000004b4c4  /bionic/bin/linker64 (__dl__ZL29__linker_init_post_relocationR19KernelArgumentBlockR6soinfo+3012)
03-15 11:39:37.129 F/DEBUG   (11688):       #04 pc 000000000004a7f0  /bionic/bin/linker64 (__dl___linker_init+416)
03-15 11:39:37.129 F/DEBUG   (11688):       #05 pc 0000000000051b24  /bionic/bin/linker64 (__dl__start+4)
--------- beginning of main
03-15 11:46:13.218 W/ActivityThread(11599): handleWindowVisibility: no activity for token android.os.BinderProxy@d1805f8
03-15 11:46:13.320 W/sh      (19192): type=1400 audit(0.0:3008): avc: denied { read } for name="/" dev="dm-3" ino=2 scontext=u:r:untrusted_app_27:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=0
03-15 11:46:13.342 I/Util    (11599): runShellCommandGetOutput: Exited with code 0
03-15 11:46:13.359 I/Adreno  (11599): QUALCOMM build                   : a717a27, I40aa93043f
03-15 11:46:13.359 I/Adreno  (11599): Build Date                       : 01/22/19
03-15 11:46:13.359 I/Adreno  (11599): OpenGL ES Shader Compiler Version: EV031.25.19.01
03-15 11:46:13.359 I/Adreno  (11599): Local Branch                     : gfx-adreno.lnx.1.0
03-15 11:46:13.359 I/Adreno  (11599): Remote Branch                    : quic/gfx-adreno.lnx.1.0
03-15 11:46:13.359 I/Adreno  (11599): Remote Branch                    : NONE
03-15 11:46:13.359 I/Adreno  (11599): Reconstruct Branch               : NOTHING
03-15 11:46:13.359 I/Adreno  (11599): Build Config                     : S P 6.0.7 AArch64
03-15 11:46:13.363 I/Adreno  (11599): PFP: 0x016ee180, ME: 0x00000000
03-15 11:46:13.367 I/ConfigStore(11599): android::hardware::configstore::V1_0::ISurfaceFlingerConfigs::hasWideColorDisplay retrieved: 1
03-15 11:46:13.368 I/ConfigStore(11599): android::hardware::configstore::V1_0::ISurfaceFlingerConfigs::hasHDRDisplay retrieved: 1
03-15 11:46:13.394 W/RenderThread(11599): type=1400 audit(0.0:3009): avc: denied { read } for name="u:object_r:vendor_default_prop:s0" dev="tmpfs" ino=25027 scontext=u:r:untrusted_app_27:s0:c512,c768 tcontext=u:object_r:vendor_default_prop:s0 tclass=file permissive=0
03-15 11:46:13.395 W/Gralloc3(11599): mapper 3.x is not supported
03-15 11:46:13.398 E/libc    (11599): Access denied finding property "vendor.gralloc.disable_ahardware_buffer"
03-15 11:46:17.566 I/Util    (11599): runShellCommandGetOutput: Exited with code 0
03-15 11:46:20.423 W/yncthingandroi(11599): resources.arsc in APK '/data/app/cn.wps.moffice_eng-sX7LgN4rYlWIrTqwPLBJXw==/base.apk' is compressed.
03-15 11:46:20.569 W/yncthingandroi(11599): resources.arsc in APK '/data/app/com.facebook.katana-LdtwmG5zsIgzImZcUcoUzA==/base.apk' is compressed.
03-15 11:46:20.580 W/yncthingandroi(11599): resources.arsc in APK '/data/app/com.facebook.katana-LdtwmG5zsIgzImZcUcoUzA==/split_arservicesoptional.apk' is compressed.
03-15 11:46:20.581 W/yncthingandroi(11599): resources.arsc in APK '/data/app/com.facebook.katana-LdtwmG5zsIgzImZcUcoUzA==/split_groupsadminrulesedit.apk' is compressed.
03-15 11:46:20.582 W/yncthingandroi(11599): resources.arsc in APK '/data/app/com.facebook.katana-LdtwmG5zsIgzImZcUcoUzA==/split_rtc.apk' is compressed.
03-15 11:46:20.595 W/yncthingandroi(11599): resources.arsc in APK '/data/app/com.facebook.orca-14T_h7P-2yaCgko8ZNLHYw==/base.apk' is compressed.
03-15 11:46:20.798 W/yncthingandroi(11599): resources.arsc in APK '/data/app/com.instagram.android-n8jxzraZ-a44-LM6Cil1Bg==/base.apk' is compressed.
03-15 11:46:21.171 I/Choreographer(11599): Skipped 49 frames!  The application may be doing too much work on its main thread.
03-15 11:46:21.180 I/OpenGLRenderer(11599): Davey! duration=827ms; Flags=1, IntendedVsync=489556296837, Vsync=490372963471, OldestInputEvent=9223372036854775807, NewestInputEvent=0, HandleInputStart=490375887285, AnimationStart=490375904003, PerformTraversalsStart=490375951139, DrawStart=490382372337, SyncQueued=490382686504, SyncStart=490382714577, IssueDrawCommandsStart=490382814264, SwapBuffers=490383565410, FrameCompleted=490383946921, DequeueBufferDuration=75000, QueueBufferDuration=136000, 
03-15 11:46:21.334 W/sh      (19222): type=1400 audit(0.0:3057): avc: denied { read } for name="/" dev="dm-3" ino=2 scontext=u:r:untrusted_app_27:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=0

[kvaster]

Python script for patching alignment: https://pastebin.com/XZMKMmMd Please note that this might not work for x86. Golang does not use TLS segment for arm/arm64, but I’m not sure if this is the same for x86. I’ve tested arm and arm64 patched libs on Pixel 3 XL with Android Q Beta.

[kvaster]

A small, but good update (at least for me 😃 … ): I’ve started with this: https://github.com/syncthing/syncthing-android/issues/1291 Following with this: https://github.com/golang/go/issues/29674 And, in general, ending with this: https://github.com/shadowsocks/v2ray-plugin-android/issues/6

First of all you should not wait for Android Q final - this will be not fixed by android itself. This is golang issue with bionic wrong tls (thread local storage) memory layout assumption. This should be fixed in golang, but probably bionic’s devs may help with this. This is a bad side of a story.

The good one is that this may be fixed by a dirty hack for arm and arm64 for now. Android crashes on library load with message of underaligned tls segment, but it seems that at least for arm and arm64 golang is unaware of this segment. I’ve tried to remove or realign this section with go build, but there was no such option… So I’ve decided to make a really dirty hack. I’ve patched .so files for arm/arm64 (arm64 is used on pixel 3). I’ve changed only one byte from 0x08 to 0x40 - PT_TLS section alignment, which is really unused. And it works now.

For arm64 the offset will be 0x1c0 For amr32 this should be 0x14c (change 0x04 to 0x20), but I’ve not checked.

Offsets were calculated according to readelf tool info and Elf32/Elf64 specification.

Anyway I’m happy with working syncthing on my Android Q beta now!