From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lf1-x133.google.com (mail-lf1-x133.google.com [IPv6:2a00:1450:4864:20::133]) by sourceware.org (Postfix) with ESMTPS id B873D3858C83 for ; Mon, 7 Feb 2022 08:36:42 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org B873D3858C83 Received: by mail-lf1-x133.google.com with SMTP id u14so25250037lfo.11 for ; Mon, 07 Feb 2022 00:36:42 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to :content-transfer-encoding; bh=+ON7U2NRTWfz+JwxRkYwGjFabhPW5EV2C5fj/H5rIsE=; b=VmM0SOqIwjp3MPiBMOs8RK0k35XBdxfuy8eYRqgIGfRsr6J9P/B9DPjCLltnn8wb+C VmwgnuV1rUOWQhuBoFgMGy8n7RWGbf0WoFmNa4D+Fsfa1RVdp/GCtMzoZuUYxFQfi80Z ng2CWBc0f2tmLyf41nNjcE0KE8A+BIanou7R2ZG9w8K70pKD8hHXrgdLpE44CiuLoURY 49G7jAevGTtMApismfXMeJVpl0KIY7Kspgm67rAo5K73AChncgqm9a+jjRJoI61luJin XyONb9daBrfNhTnOcdlW3vc0hk4pvu57kb0C7XrjuDeT98UHW/FCEyVQhxj9DgODwSu2 mFaQ== X-Gm-Message-State: AOAM530JRjLU7muCpXNLWjVDetLZgSZDFAdDlA5w52YJykrcruU3fulT XI59fhQr/LgT186xhg6/etA= X-Google-Smtp-Source: ABdhPJzBQYdExOpVB8zX5XL1+BZHDfoVMTpgpzjkV3vmRs8PIL5WV8PiIF8z4jlQk6lizLF1aHNVMg== X-Received: by 2002:a05:6512:2342:: with SMTP id p2mr7627090lfu.382.1644223000746; Mon, 07 Feb 2022 00:36:40 -0800 (PST) Received: from [192.168.10.175] (37-247-29-68.customers.ownit.se. [37.247.29.68]) by smtp.gmail.com with ESMTPSA id n9sm1405510lfi.227.2022.02.07.00.36.39 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 07 Feb 2022 00:36:40 -0800 (PST) Message-ID: <8d9d02de-1a59-1f4d-dbcf-050b65abef29@gmail.com> Date: Mon, 7 Feb 2022 09:36:39 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.5.0 Subject: Re: Debugging ld.so in gdb Content-Language: en-US To: Florian Weimer Cc: Jacob Kroon via Gdb References: <29e0ef71-4706-9b0f-2a68-e12c54120d8e@gmail.com> <8735kypwcd.fsf@oldenburg.str.redhat.com> <87y22qognw.fsf@oldenburg.str.redhat.com> <87h79eobq1.fsf@oldenburg.str.redhat.com> <87czk2o967.fsf@oldenburg.str.redhat.com> <06f726f4-855e-239b-fd2c-8d0d57f45131@gmail.com> <878ruqo8o2.fsf@oldenburg.str.redhat.com> From: Jacob Kroon In-Reply-To: <878ruqo8o2.fsf@oldenburg.str.redhat.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, NICE_REPLY_A, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: gdb@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gdb mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Feb 2022 08:36:44 -0000 Hi Florian, On 2/4/22 18:15, Florian Weimer wrote: > I suspect we are writing beyond the start of the array passed to > _dl_sort_maps. > It looks like it is writing passed the beginning of the rpo[] array in _dl_sort_maps_dfs(). The output below is right before the crash happens (stepping one instruction garbles the backtrace): > (gdb) bt > #0 dfs_traversal (rpo=rpo@entry=0x7fffffffd320, map=0x7ffff7fad590, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:175 > #1 0x00007ffff7fd85d4 in dfs_traversal (do_reldeps=0x0, map=, rpo=0x7fffffffd320) at dl-sort-maps.c:143 > #2 dfs_traversal (rpo=rpo@entry=0x7fffffffd320, map=0x7ffff7fadb70, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:155 > #3 0x00007ffff7fd89cd in dfs_traversal (do_reldeps=0x0, map=, rpo=0x7fffffffd320) at dl-sort-maps.c:143 > #4 _dl_sort_maps_dfs (skip=, for_fini=, nmaps=15, maps=0x7ffff7953de0) at dl-sort-maps.c:233 > #5 _dl_sort_maps (maps=maps@entry=0x7ffff7953de0, nmaps=nmaps@entry=15, skip=, for_fini=for_fini@entry=false) at dl-sort-maps.c:299 > #6 0x00007ffff7fcaf0f in _dl_map_object_deps (map=, preloads=, npreloads=, trace_mode=, > open_mode=) at dl-deps.c:616 > #7 0x00007ffff7fe6970 in dl_main (phdr=, phnum=, user_entry=, auxv=) at rtld.c:1968 > #8 0x00007ffff7fe2c7c in _dl_sysdep_start (start_argptr=, dl_main=0x7ffff7fe4bb0 ) at ../elf/dl-sysdep.c:264 > #9 0x00007ffff7fe4678 in _dl_start_final (arg=0x7fffffffdec0) at rtld.c:493 > #10 _dl_start (arg=0x7fffffffdec0) at rtld.c:587 > #11 0x00007ffff7fe36a8 in _start () > (gdb) f 0 > #0 dfs_traversal (rpo=rpo@entry=0x7fffffffd320, map=0x7ffff7fad590, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:175 > 175 **rpo = map; > (gdb) print *rpo > $62 = (struct link_map **) 0x7fffffffd238 > (gdb) f 4 > #4 _dl_sort_maps_dfs (skip=, for_fini=, nmaps=15, maps=0x7ffff7953de0) at dl-sort-maps.c:233 > 233 dfs_traversal (&rpo_head, maps[i], do_reldeps_ref); > (gdb) print &rpo[-1] > $63 = (struct link_map **) 0x7fffffffd238 I inspected the "maps" vector and it containes *multiple* entries to "libjvm.so", is that allowed ? I wonder if "nmaps" is calculated correctly, since that determines the array size. Can I verify that somehow ? Any other ideas I should try ? Jacob