commit 9ffa50b26b0cb5d3043adf6d3d0b1ea735acc147
Author: Florian Weimer <fweimer@redhat.com>
Date:   Fri Dec 11 17:30:03 2020 +0100

    elf: Include libc.so.6 as main program in dependency sort (bug 20972)
    
    _dl_map_object_deps always sorts the initially loaded object first
    during dependency sorting.  This means it is relocated last in
    dl_open_worker.  This results in crashes in IFUNC resolvers without
    lazy bindings if libraries are preloaded that refer to IFUNCs in
    libc.so.6: the resolvers are called when libc.so.6 has not been
    relocated yet, so references to _rtld_global_ro etc. crash.
    
    The fix is to check against the libc.so.6 link map recorded by the
    __libc_early_init framework, and let it participate in the dependency
    sort.
    
    This fixes bug 20972.
    
    Reviewed-by: Carlos O'Donell <carlos@redhat.com>

Conflicts:
	elf/Makefile
	  (Usual test backport differences.)

diff --git a/elf/Makefile b/elf/Makefile
index 67029930dd2cb461..fc9c685b9d23bb6c 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -215,7 +215,7 @@ tests-internal += loadtest unload unload2 circleload1 \
 	 tst-tls3 tst-tls6 tst-tls7 tst-tls8 tst-dlmopen2 \
 	 tst-ptrguard1 tst-stackguard1 tst-libc_dlvsym \
 	 tst-create_format1 tst-tls-surplus tst-dl-hwcaps_split
-tests-container += tst-pldd
+tests-container += tst-pldd tst-preload-pthread-libc
 ifeq ($(build-hardcoded-path-in-tests),yes)
 tests += tst-dlopen-aout
 tst-dlopen-aout-no-pie = yes
diff --git a/elf/dl-deps.c b/elf/dl-deps.c
index 50f053a1586efdc3..007069f670eced95 100644
--- a/elf/dl-deps.c
+++ b/elf/dl-deps.c
@@ -610,7 +610,12 @@ Filters not supported with LD_TRACE_PRELINKING"));
     memcpy (l_initfini, map->l_searchlist.r_list,
 	    nlist * sizeof (struct link_map *));
 
-  _dl_sort_maps (&l_initfini[1], nlist - 1, NULL, false);
+  /* If libc.so.6 is the main map, it participates in the sort, so
+     that the relocation order is correct regarding libc.so.6.  */
+  if (l_initfini[0] == GL (dl_ns)[l_initfini[0]->l_ns].libc_map)
+    _dl_sort_maps (l_initfini, nlist, NULL, false);
+  else
+    _dl_sort_maps (&l_initfini[1], nlist - 1, NULL, false);
 
   /* Terminate the list of dependencies.  */
   l_initfini[nlist] = NULL;
diff --git a/elf/tst-preload-pthread-libc.c b/elf/tst-preload-pthread-libc.c
new file mode 100644
index 0000000000000000..48cb512a93f3da19
--- /dev/null
+++ b/elf/tst-preload-pthread-libc.c
@@ -0,0 +1,36 @@
+/* Test relocation ordering if the main executable is libc.so.6 (bug 20972).
+   Copyright (C) 2020 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <gnu/lib-names.h>
+#include <stdio.h>
+#include <support/support.h>
+#include <unistd.h>
+
+int
+main (void)
+{
+  char *libc = xasprintf ("%s/%s", support_slibdir_prefix, LIBC_SO);
+  char *argv[] = { libc, NULL };
+  char *envp[] = { (char *) "LD_PRELOAD=" LIBPTHREAD_SO,
+    /* Relocation ordering matters most without lazy binding.  */
+    (char *) "LD_BIND_NOW=1",
+    NULL };
+  execve (libc, argv, envp);
+  printf ("execve of %s failed: %m\n", libc);
+  return 1;
+}