From: Florian Weimer <fweimer@redhat.com>
To: GCC <gcc@gcc.gnu.org>, GNU C Library <libc-alpha@sourceware.org>,
Binutils <binutils@sourceware.org>,
gnu-gabi@sourceware.org
Subject: Invalid program counters and unwinding
Date: Tue, 26 Jun 2018 10:56:00 -0000 [thread overview]
Message-ID: <ae764484-5bd4-5e40-ed50-81209eb54360@redhat.com> (raw)
I'm looking at ways to speed up _Unwind_Find_FDE when libgcc is running
on top of glibc. I have something (at the design level, with some of
the code written) which allows me to get a pointer to the
PT_GNU_EH_FRAME segment in memory in a lock-free fashion (so it would
also be async-signal safe).
This part works also when the program counter used in the search is
invalid and does not point to within a loaded object, even in the case
of concurrent dlopen/dlclose.
However, it's still necessary to read the PT_GNU_EH_FRAME data itself,
and if _Unwind_Find_FDE is not a valid program counter found on the
stack (with in a caller, where unmapping it with dlclose would be
invalid), it could happen that it is a random address in *another*,
unrelated object, which then gets dlclose'd (which is valid).
The current glibc-based implementation in libgcc calls dl_iterate_phdr,
which acquires a lock blocking dlclose for the entire duration of the
iteration. But I think this still doesn't support arbitrary, random PC
values because in the worst case, the PC value looks valid, we find some
unrelated FDE data with an associated personality routine, and end up
calling that, with disastrous consequences.
So it looks to me that the caller of _Unwind_Find_FDE needs to ensure
that the PC is a valid element of the call stack. Is this a correct
assumption?
I have some ideas how make reading the PT_GNU_EH_FRAME data safe, but
the question is whether we actually need that.
Previous discussions:
https://gcc.gnu.org/ml/gcc/2013-05/msg00253.html
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71744
https://sourceware.org/ml/libc-alpha/2016-07/msg00613.html
(patch with a spread lock, still not async-signal-safe)
Thanks,
Florian
next reply other threads:[~2018-06-26 9:26 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-26 10:56 Florian Weimer [this message]
2018-06-26 11:01 ` Nathan Sidwell
2018-06-26 11:15 ` Florian Weimer
2018-06-26 11:21 ` Nathan Sidwell
2018-06-26 11:25 ` Florian Weimer
2018-06-26 11:39 ` Nathan Sidwell
2018-06-26 11:46 ` Florian Weimer
2018-06-26 11:46 ` Jakub Jelinek
2018-06-26 14:08 ` Nathan Sidwell
2018-06-26 11:31 ` Jakub Jelinek
2018-06-26 11:35 ` Florian Weimer
2018-06-28 11:32 ` Jeff Law
2018-06-28 14:18 ` Florian Weimer
2018-06-28 14:49 ` Jeff Law
2018-06-28 15:23 ` Florian Weimer
2018-07-02 15:48 ` Michael Matz
2018-07-02 15:54 ` Jakub Jelinek
2018-07-02 16:14 ` Michael Matz
2018-07-05 19:31 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ae764484-5bd4-5e40-ed50-81209eb54360@redhat.com \
--to=fweimer@redhat.com \
--cc=binutils@sourceware.org \
--cc=gcc@gcc.gnu.org \
--cc=gnu-gabi@sourceware.org \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).