From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lf1-x132.google.com (mail-lf1-x132.google.com [IPv6:2a00:1450:4864:20::132]) by sourceware.org (Postfix) with ESMTPS id CB3273858D20 for ; Mon, 7 Feb 2022 12:15:54 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org CB3273858D20 Received: by mail-lf1-x132.google.com with SMTP id n8so26442934lfq.4 for ; Mon, 07 Feb 2022 04:15:54 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=MRv5noXCeJdmZuID6U/fQoPUnvv5nPSxdTBoskYeT3I=; b=sKTMwLVXj8glwp9grDhUV7cAyMg0Zao0h3smzdaEJFNdpiNQNDnZOvld9h/yZ4NlwB qXrv+Iv9/3uuw732G4nIhypjFPc7LMae9G4aslLKuVb6ZPONZZm3GnllN40oI2gs5+aY 2DEu54wva68yRJzjbLhfFnXom3wxKdS1Eu2WPUcubArbBj+1HYgJqC9G88eFkNk4nmAJ t91nLftFyHVPHyfu5/SfKpAvbnKNp7LEoDZk+FGkqJjv9dghYrhBJXuE48ExtZLuK9pg p/sw8T9kDjWdtsaVC59Ir8kTs7agBtvznuaNV5weTHs8awWN3ls9pdx1bLbAl37fyIcj mD4g== X-Gm-Message-State: AOAM5334yD3h4agRAxonyVDlBLEBeozyPmFvQwC7jRTlF69LlZX2Mr3i unVn0vHgK2pCfNIVk3PrzKo= X-Google-Smtp-Source: ABdhPJx5Jv35kEeG4+8j5vR88HSfxYhETqxoFHg0zgY51gkILa6pTHOF08eoObM2RJtTuSUHRrFuMw== X-Received: by 2002:ac2:4577:: with SMTP id k23mr8322933lfm.258.1644236153738; Mon, 07 Feb 2022 04:15:53 -0800 (PST) Received: from [192.168.10.175] (37-247-29-68.customers.ownit.se. [37.247.29.68]) by smtp.gmail.com with ESMTPSA id f22sm1486643lfj.261.2022.02.07.04.15.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 07 Feb 2022 04:15:52 -0800 (PST) Message-ID: <3e08e7c7-05f5-16f2-50cb-036687386997@gmail.com> Date: Mon, 7 Feb 2022 13:15:28 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.5.0 Subject: Re: Debugging ld.so in gdb Content-Language: en-US To: Florian Weimer Cc: Jacob Kroon via Gdb References: <29e0ef71-4706-9b0f-2a68-e12c54120d8e@gmail.com> <8735kypwcd.fsf@oldenburg.str.redhat.com> <87y22qognw.fsf@oldenburg.str.redhat.com> <87h79eobq1.fsf@oldenburg.str.redhat.com> <87czk2o967.fsf@oldenburg.str.redhat.com> <06f726f4-855e-239b-fd2c-8d0d57f45131@gmail.com> <878ruqo8o2.fsf@oldenburg.str.redhat.com> <8d9d02de-1a59-1f4d-dbcf-050b65abef29@gmail.com> <93cd41d6-e333-f31e-96bb-2f34a88f164f@gmail.com> <875ypqc2ma.fsf@oldenburg.str.redhat.com> From: Jacob Kroon In-Reply-To: <875ypqc2ma.fsf@oldenburg.str.redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, NICE_REPLY_A, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: gdb@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gdb mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Feb 2022 12:15:56 -0000 On 2/7/22 12:55, Florian Weimer wrote: > * Jacob Kroon: > >> On 2/7/22 09:36, Jacob Kroon wrote: >>> Hi Florian, >>> >>> On 2/4/22 18:15, Florian Weimer wrote: >>>> I suspect we are writing beyond the start of the array passed to >>>> _dl_sort_maps. >>>> >>> >>> It looks like it is writing passed the beginning of the rpo[] array in >>> _dl_sort_maps_dfs(). The output below is right before the crash happens >>> (stepping one instruction garbles the backtrace): >>> >>>> (gdb) bt >>>> #0 dfs_traversal (rpo=rpo@entry=0x7fffffffd320, map=0x7ffff7fad590, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:175 >>>> #1 0x00007ffff7fd85d4 in dfs_traversal (do_reldeps=0x0, map=, rpo=0x7fffffffd320) at dl-sort-maps.c:143 >>>> #2 dfs_traversal (rpo=rpo@entry=0x7fffffffd320, map=0x7ffff7fadb70, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:155 >>>> #3 0x00007ffff7fd89cd in dfs_traversal (do_reldeps=0x0, map=, rpo=0x7fffffffd320) at dl-sort-maps.c:143 >>>> #4 _dl_sort_maps_dfs (skip=, for_fini=, nmaps=15, maps=0x7ffff7953de0) at dl-sort-maps.c:233 >>>> #5 _dl_sort_maps (maps=maps@entry=0x7ffff7953de0, nmaps=nmaps@entry=15, skip=, for_fini=for_fini@entry=false) at dl-sort-maps.c:299 >>>> #6 0x00007ffff7fcaf0f in _dl_map_object_deps (map=, preloads=, npreloads=, trace_mode=, >>>> open_mode=) at dl-deps.c:616 >>>> #7 0x00007ffff7fe6970 in dl_main (phdr=, phnum=, user_entry=, auxv=) at rtld.c:1968 >>>> #8 0x00007ffff7fe2c7c in _dl_sysdep_start (start_argptr=, dl_main=0x7ffff7fe4bb0 ) at ../elf/dl-sysdep.c:264 >>>> #9 0x00007ffff7fe4678 in _dl_start_final (arg=0x7fffffffdec0) at rtld.c:493 >>>> #10 _dl_start (arg=0x7fffffffdec0) at rtld.c:587 >>>> #11 0x00007ffff7fe36a8 in _start () >>>> (gdb) f 0 >>>> #0 dfs_traversal (rpo=rpo@entry=0x7fffffffd320, map=0x7ffff7fad590, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:175 >>>> 175 **rpo = map; >>>> (gdb) print *rpo >>>> $62 = (struct link_map **) 0x7fffffffd238 >>>> (gdb) f 4 >>>> #4 _dl_sort_maps_dfs (skip=, for_fini=, nmaps=15, maps=0x7ffff7953de0) at dl-sort-maps.c:233 >>>> 233 dfs_traversal (&rpo_head, maps[i], do_reldeps_ref); >>>> (gdb) print &rpo[-1] >>>> $63 = (struct link_map **) 0x7fffffffd238 >>> >>> I inspected the "maps" vector and it containes *multiple* entries to >>> "libjvm.so", is that allowed ? I wonder if "nmaps" is calculated >>> correctly, since that determines the array size. Can I verify that somehow ? > > Curiously I was wondering about duplicates as well as I couldn't sleep. > > Do you use DT_FILTER or anything unusual? What about LD_PRELOAD? > Not sure what "DT_FILTER" is, but it is not something that shows up if I run "readelf -a" on the library in question. I don't have LD_PRELOAD set in my environment. >> Actually that is was not correct. "maps[]->l_name" does not contain any >> "libjvm.so" at all, but the resulting rpo[] does contain several >> "libjvm.so" entries. > > What I find really confusing is that this is not the result of a dlopen > call. I definitely would expect that the maps array contains *all* > objects that are being loaded. Clearly this is not the case here. > Somehow certain objects are missing, and then they get written into the > rpo array. > > Please try to find libjvm.so among the l_initfini arrays of the objects. I do find libjvm.so in a couple of the maps[]->l_initfini[]->l_name arrays, yes. > It must be present somewhere. I assume it's also on the main list, > which starts off at _rtld_global._dl_ns[0]._ns_loaded. Hmm how do I iterate over that data structure ? See below: > (gdb) print _rtld_global._dl_ns[0]._ns_loaded[0]->l_name > $186 = 0x7ffff7ff1d97 "" > (gdb) print _rtld_global._dl_ns[0]._ns_loaded[1]->l_name > $187 = 0x0 > (gdb) print _rtld_global._dl_ns[0]._ns_loaded[2]->l_name > $188 = 0x0 > (gdb) print _rtld_global._dl_ns[0]._ns_loaded->l_name > $189 = 0x7ffff7ff1d97 "" > (gdb) print _rtld_global._dl_ns[1]._ns_loaded->l_name > Cannot access memory at address 0x8 > (gdb) print _rtld_global._dl_ns[2]._ns_loaded->l_name > Cannot access memory at address 0x8 Jacob