From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gdb-prs-return-12269-listarch-gdb-prs=sources.redhat.com@sourceware.org>
Received: (qmail 25003 invoked by alias); 6 Sep 2012 09:29:51 -0000
Received: (qmail 24981 invoked by uid 22791); 6 Sep 2012 09:29:50 -0000
X-SWARE-Spam-Status: No, hits=-3.1 required=5.0
	tests=ALL_TRUSTED,AWL,BAYES_00
X-Spam-Check-By: sourceware.org
Received: from localhost (HELO sourceware.org) (127.0.0.1)
    by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Thu, 06 Sep 2012 09:29:36 +0000
From: "sanjoy at playingwithpointers dot com"
 <sourceware-bugzilla@sourceware.org>
To: gdb-prs@sourceware.org
Subject: [Bug backtrace/14550] New: Loading a custom JIT reader plugin
 crashes GDB during backtrace
Date: Thu, 06 Sep 2012 09:29:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gdb
X-Bugzilla-Component: backtrace
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: sanjoy at playingwithpointers dot com
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: sanjoy at playingwithpointers dot com
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Changed-Fields: 
Message-ID: <bug-14550-4717@http.sourceware.org/bugzilla/>
X-Bugzilla-URL: http://sourceware.org/bugzilla/
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0
Mailing-List: contact gdb-prs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Id: <gdb-prs.sourceware.org>
List-Subscribe: <mailto:gdb-prs-subscribe@sourceware.org>
List-Archive: <http://sourceware.org/ml/gdb-prs/>
List-Post: <mailto:gdb-prs@sourceware.org>
List-Help: <mailto:gdb-prs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: gdb-prs-owner@sourceware.org
X-SW-Source: 2012-q3/txt/msg00320.txt.bz2

http://sourceware.org/bugzilla/show_bug.cgi?id=14550

             Bug #: 14550
           Summary: Loading a custom JIT reader plugin crashes GDB during
                    backtrace
           Product: gdb
           Version: unknown
            Status: NEW
          Severity: normal
          Priority: P2
         Component: backtrace
        AssignedTo: sanjoy@playingwithpointers.com
        ReportedBy: sanjoy@playingwithpointers.com
    Classification: Unclassified


Sample code (from Michael Haupt <michael.haupt@oracle.com> with minor
modifications):

To crash GDB, jit-reader-load myreader.c and break inside the `func` function
in jithost.c

myreader.c: 

#include "gdb/jit-reader.h"

GDB_DECLARE_GPL_COMPATIBLE_READER;

static enum gdb_status read_debug_info(struct gdb_reader_funcs* self,
                                       struct gdb_symbol_callbacks* cbs,
                                       void* memory, long memory_sz) {
    GDB_CORE_ADDR* buf = (GDB_CORE_ADDR*) memory;
    GDB_CORE_ADDR start = buf[0];
    GDB_CORE_ADDR end = buf[1];

    struct gdb_object* object = cbs->object_open(cbs);
    struct gdb_symtab* symtab = cbs->symtab_open(cbs, object, "");
    struct gdb_block* block = cbs->block_open(cbs, symtab, NULL, start, end,
                                              "fluffy");

    cbs->symtab_close(cbs, symtab);
    cbs->object_close(cbs, object);
    return GDB_SUCCESS;
}

enum gdb_status unwind_frame(struct gdb_reader_funcs* self,
                             struct gdb_unwind_callbacks* cbs) {
    return GDB_SUCCESS;
}

struct gdb_frame_id get_frame_id(struct gdb_reader_funcs* self,
                                 struct gdb_unwind_callbacks* cbs) {
    struct gdb_frame_id frame = { 0x602000, 0 };
    return frame;
}

void destroy_reader(struct gdb_reader_funcs* self) { }

extern struct gdb_reader_funcs* gdb_init_reader(void) {
    static struct gdb_reader_funcs funcs = {
        GDB_READER_INTERFACE_VERSION,
    NULL,
    read_debug_info,
    unwind_frame,
    get_frame_id,
    destroy_reader
    };
    return &funcs;
}


jithost.c:


#include <stdio.h>
#include <sys/mman.h>

#include "gdb/jit-reader.h"
#include "defs.h"
#include "jit.h"

struct jit_descriptor __jit_debug_descriptor = { 1, 0, 0, 0 };
struct jit_code_entry entry = { 0, 0, 0, 0 };

typedef void (*func)();

void __attribute__((noinline)) __jit_debug_register_code() {
    __asm("");
}

#define SIZE 4096

int main(int argc, char** argv) {
    char* code = (char*) valloc(SIZE);
    GDB_CORE_ADDR* buffer = (GDB_CORE_ADDR*) valloc(SIZE);
    fprintf(stderr, "buffer at %p, code at %p\n", buffer, code);

    if (0 != mprotect(code, SIZE, PROT_WRITE | PROT_READ | PROT_EXEC)) {
        perror(NULL);
    exit(3);
    }

    code[0] = 0xc3; // RET
    buffer[0] = (GDB_CORE_ADDR) code; // store code address in buffer
    buffer[1] = (GDB_CORE_ADDR) (code + 1); // and the end of the generated
"function"

    entry.symfile_addr = (GDB_CORE_ADDR) buffer;
    entry.symfile_size = SIZE;

    __jit_debug_descriptor.first_entry =
         __jit_debug_descriptor.relevant_entry = (GDB_CORE_ADDR) &entry;
    __jit_debug_descriptor.action_flag = JIT_REGISTER;
    __jit_debug_descriptor.version = 1;
    __jit_debug_register_code();

    (((func)(code)))();

    return 0;
}

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.