why the DSO was loaded at address 0 - loader

Question

There is a simple test program,it dlopen()s a DSO "/lib/libc.so.6" and then print the address of symbol "printf".
#include <dlfcn.h>
#include <stdio.h>
int main() {
void* handle;
void (*func)();
char* error_test;
if (handle = dlopen("/lib/libc.so.6", RTLD_NOW)) {
func = dlsym(handle, "printf");
(*func)("address:%p\n",func);
sleep(-1);
dlclose(handle);
return 0;
}
return -1;
}
When I debug it with "LD_DEBUG=all",it shows that:
[root#localhost glibc_test]# LD_DEBUG=all LD_DEBUG_OUTPUT=error ./test &
[18] 14690
[root#localhost glibc_test]# address:0x2f87b0
But the file "error" shows that "/lib/libc.so.6" was loaded to address 0! That`s why?
14690: initialize program: ./test
14690:
14690:
14690: transferring control: ./test
14690:
14690: symbol=dlopen; lookup in file=./test [0]
14690: symbol=dlopen; lookup in file=/changed_glibc/lib/libdl.so.2 [0]
14690: binding file ./test [0] to /changed_glibc/lib/libdl.so.2 [0]: normal symbol `dlopen' [GLIBC_2.1]
14690:
14690: file=/lib/libc.so.6 [0]; needed by ./test [0]
14690: file=/lib/libc.so.6 [0]; generating link map
14690: dynamic: 0x0043cd7c base: 0x00000000 size: 0x00191988
14690: entry: 0x002c5e40 phdr: 0x002af034 phnum: 10
What`s more,the "/proc/14270/maps" file perform normal,and the address of symbol "func"(0x2f87b0) in the test program lies in right range(002af000-0043b000).
[root#localhost ~]# cat /proc/14690/maps
002af000-0043b000 r-xp 00000000 fd:00 1714117 /lib/libc-2.12.so
0043b000-0043d000 r--p 0018c000 fd:00 1714117 /lib/libc-2.12.so
0043d000-0043e000 rw-p 0018e000 fd:00 1714117 /lib/libc-2.12.so
0043e000-00441000 rw-p 00000000 00:00 0

Answer 1

The issue is related to "prelink",when a DSO is loading, it has been prelinked to a certain address.