why the DSO was loaded at address 0

Question

There is a simple test program,it dlopen()s a DSO "/lib/libc.so.6" and then print the address of symbol "printf".

#include <dlfcn.h>
#include <stdio.h>

int main() {
    void* handle;
    void (*func)();
    char* error_test;
    if (handle = dlopen("/lib/libc.so.6", RTLD_NOW)) {
        func = dlsym(handle, "printf");
        (*func)("address:%p\n",func);
        sleep(-1);
        dlclose(handle);
        return 0;
    }
    return -1;
}

When I debug it with "LD_DEBUG=all",it shows that:

[root@localhost glibc_test]# LD_DEBUG=all LD_DEBUG_OUTPUT=error ./test &
[18] 14690
[root@localhost glibc_test]# address:0x2f87b0

But the file "error" shows that "/lib/libc.so.6" was loaded to address 0! That`s why?

 14690: initialize program: ./test
 14690: 
 14690: 
 14690: transferring control: ./test
 14690: 
 14690: symbol=dlopen;  lookup in file=./test [0]
 14690: symbol=dlopen;  lookup in file=/changed_glibc/lib/libdl.so.2 [0]
 14690: binding file ./test [0] to /changed_glibc/lib/libdl.so.2 [0]: normal symbol `dlopen' [GLIBC_2.1]
 14690: 
 14690: file=/lib/libc.so.6 [0];  needed by ./test [0]
 14690: file=/lib/libc.so.6 [0];  generating link map
 14690:   dynamic: 0x0043cd7c  base: 0x00000000   size: 0x00191988
 14690:     entry: 0x002c5e40  phdr: 0x002af034  phnum:         10

What`s more,the "/proc/14270/maps" file perform normal,and the address of symbol "func"(0x2f87b0) in the test program lies in right range(002af000-0043b000).

[root@localhost ~]# cat /proc/14690/maps 
002af000-0043b000 r-xp 00000000 fd:00 1714117    /lib/libc-2.12.so
0043b000-0043d000 r--p 0018c000 fd:00 1714117    /lib/libc-2.12.so
0043d000-0043e000 rw-p 0018e000 fd:00 1714117    /lib/libc-2.12.so
0043e000-00441000 rw-p 00000000 00:00 0 

Answer 1

The issue is related to "prelink",when a DSO is loading, it has been prelinked to a certain address.