Re: [patch] Fix resolving ELF symbols for live PIDs with deleted files

Re: [patch] Fix resolving ELF symbols for live PIDs with deleted files

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 656 bytes --]

On Fri, Aug 29, 2014 at 10:38:55PM +0200, Jan Kratochvil wrote:
> On Fri, 29 Aug 2014 22:15:50 +0200, Jan Kratochvil wrote:
> > When I remove the check on 2.6.32 (tested on kernel-2.6.32-431.el6.x86_64) the
> > testcase really FAILs:
> > 	.../elfutils/src/stack: dwfl_thread_getframes tid 26376 at 0x4006c8 in .../elfutils/tests/deleted: no matching address range
> 
> It was just due to the missing CFI at the '_start' symbol.
> 
> Updated the testcase to ignore that error.  And removed the 2.6.32 SKIP.

O, that makes sense. And a simple workaround, very nice.

> Updated the patch for new approval.

Yes, please push.

Thanks,

Mark

Re: [patch] Fix resolving ELF symbols for live PIDs with deleted files

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 847 bytes --]

On Fri, Aug 29, 2014 at 10:15:50PM +0200, Jan Kratochvil wrote:
> On Fri, 29 Aug 2014 11:55:32 +0200, Mark Wielaard wrote:
> > I don't think this check is needed. eu-stack needs to be attached to get
> > the register values and dwfl_linux_proc_find_elf makes sure the process
> > is attached before calling elf_from_remote_memory.
> 
> When I remove the check on 2.6.32 (tested on kernel-2.6.32-431.el6.x86_64) the
> testcase really FAILs:
> 	.../elfutils/src/stack: dwfl_thread_getframes tid 26376 at 0x4006c8 in .../elfutils/tests/deleted: no matching address range
> 
> I can debug it further but I guess at least this patch could go in as is (with
> the kernel check).

O, interesting. Thanks for checking. Yes, please check it in with the
check then. And please file a bug so we won't forget to investigate.

Thanks,

Mark

Re: [patch] Fix resolving ELF symbols for live PIDs with deleted files

[Jan Kratochvil]

[-- Attachment #1: Type: text/plain, Size: 491 bytes --]

On Fri, 29 Aug 2014 22:15:50 +0200, Jan Kratochvil wrote:
> When I remove the check on 2.6.32 (tested on kernel-2.6.32-431.el6.x86_64) the
> testcase really FAILs:
> 	.../elfutils/src/stack: dwfl_thread_getframes tid 26376 at 0x4006c8 in .../elfutils/tests/deleted: no matching address range

It was just due to the missing CFI at the '_start' symbol.

Updated the testcase to ignore that error.  And removed the 2.6.32 SKIP.

Updated the patch for new approval.


Thanks,
Jan

[-- Attachment #2: attachment.mht --]
[-- Type: message/rfc822, Size: 47 bytes --]


WzxlbWFpbC5tZXNzYWdlLk1lc3NhZ2UgaW5zdGFuY2UgYXQgMHgyYjZjN2U4Pl0=

Re: [patch] Fix resolving ELF symbols for live PIDs with deleted files

[Jan Kratochvil]

[-- Attachment #1: Type: text/plain, Size: 1054 bytes --]

On Fri, 29 Aug 2014 11:55:32 +0200, Mark Wielaard wrote:
> On Thu, 2014-08-28 at 22:12 +0200, Jan Kratochvil wrote:
> > +# Older Linux (such as 2.6.32) required PTRACE_ATTACH to read /proc/PID/mem.
> > +sleep 60 & p=$!; sleep 0.1
> > +addr=0x$(cat /proc/$p/maps|sed -n 's#^\([0-9a-f]*\)-[0-9a-f]* r[^ ]* 00* .*/sleep$#\1#p'|head -n1)
> > +supported=$[$(dd if=/proc/$p/mem bs=1 skip=$[$addr] count=1|wc -c)]
> > +kill -9 $p
> > +if [ $supported -eq 0 ]; then
> > +  exit 77
> > +fi
>  
> I don't think this check is needed. eu-stack needs to be attached to get
> the register values and dwfl_linux_proc_find_elf makes sure the process
> is attached before calling elf_from_remote_memory.

When I remove the check on 2.6.32 (tested on kernel-2.6.32-431.el6.x86_64) the
testcase really FAILs:
	.../elfutils/src/stack: dwfl_thread_getframes tid 26376 at 0x4006c8 in .../elfutils/tests/deleted: no matching address range

I can debug it further but I guess at least this patch could go in as is (with
the kernel check).


Thanks,
Jan

Re: [patch] Fix resolving ELF symbols for live PIDs with deleted files

[Mark Wielaard]

[-- Attachment #1: Type: text/plain, Size: 1355 bytes --]

On Thu, 2014-08-28 at 22:12 +0200, Jan Kratochvil wrote:
> Formerly shared libraries did not get resolved properly:
> 	#2  0x00007fc4d86c56d6
> 	#3  0x0000000000400938 main
> 
> Fixed elfutils produce:
> 	#2  0x00007f61094876d6 libfunc
> 	#3  0x0000000000400938 main
> 
> Signed-off-by: Jan Kratochvil <jan.kratochvil@redhat.com>

Nice, thanks. I would add the why to the commit message. "For deleted
shared library files the offsets to the symbol table were calculated
wrongly from the phdrs because the main_bias wasn't taken into account."

+2014-08-28  Jan Kratochvil  <jan.kratochvil@redhat.com>
> +
> +	* dwfl_module_getdwarf.c (find_offsets): Add parameter main_bias, use
> +	it.
> +	(find_dynsym): Pass the new parameter main_bias.
> 
Looks good.

+# Older Linux (such as 2.6.32) required PTRACE_ATTACH to read /proc/PID/mem.
> +sleep 60 & p=$!; sleep 0.1
> +addr=0x$(cat /proc/$p/maps|sed -n 's#^\([0-9a-f]*\)-[0-9a-f]* r[^ ]* 00* .*/sleep$#\1#p'|head -n1)
> +supported=$[$(dd if=/proc/$p/mem bs=1 skip=$[$addr] count=1|wc -c)]
> +kill -9 $p
> +if [ $supported -eq 0 ]; then
> +  exit 77
> +fi
 
I don't think this check is needed. eu-stack needs to be attached to get
the register values and dwfl_linux_proc_find_elf makes sure the process
is attached before calling elf_from_remote_memory.

Cheers,

Mark

[patch] Fix resolving ELF symbols for live PIDs with deleted files

[Jan Kratochvil]

[-- Attachment #1: Type: text/plain, Size: 144 bytes --]

Hi,

jankratochvil/deleted
https://bugzilla.redhat.com/show_bug.cgi?id=1130781#c3

Implemented the fix suggested there.


Thanks,
Jan

[-- Attachment #2: attachment.mht --]
[-- Type: message/rfc822, Size: 47 bytes --]


WzxlbWFpbC5tZXNzYWdlLk1lc3NhZ2UgaW5zdGFuY2UgYXQgMHgyYTdkZDQwPl0=