* Suspected bug in DW_OP_addr handling
@ 2022-05-07 3:54 Yichao Yu
2022-05-08 17:25 ` Simon Marchi
0 siblings, 1 reply; 3+ messages in thread
From: Yichao Yu @ 2022-05-07 3:54 UTC (permalink / raw)
To: gdb
I noticed that gdb unwind failed with read of invalid memory address
when I used `DW_OP_addr` in my unwind info. Upon checking, it seems
that the handling of this operation in the dwarf interpreter is very
suspicious.
The interpreter for the op code has a comment[1] sayijng,
> Some versions of GCC emit DW_OP_addr before
> DW_OP_GNU_push_tls_address. In this case the value is an
> index, not an address.
However, the code appears to check for exactly the opposite condition
`op_ptr >= op_end || *op_ptr != DW_OP_GNU_push_tls_address` to decide
whether the result should be used as index. This was added 12 years
ago in commit ac56253ddece [2].
Am I missing something or is this a long-standing bug?
Yichao
[1] https://github.com/bminor/binutils-gdb/blob/2392dc0f8e243a4f5f9d0db6cee64a1698886e56/gdb/dwarf2/expr.c#L1574-L1585
[2] https://github.com/bminor/binutils-gdb/commit/ac56253ddece35aff4402b848f88ba40856102b1#diff-9c28445d6bd87cff9dcb11dc4b58ff0e605a078b08ceb37da22d8d2c7b866f6aR406
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Suspected bug in DW_OP_addr handling
2022-05-07 3:54 Suspected bug in DW_OP_addr handling Yichao Yu
@ 2022-05-08 17:25 ` Simon Marchi
2022-05-09 14:03 ` Yichao Yu
0 siblings, 1 reply; 3+ messages in thread
From: Simon Marchi @ 2022-05-08 17:25 UTC (permalink / raw)
To: Yichao Yu, gdb
On 2022-05-06 23:54, Yichao Yu via Gdb wrote:
> I noticed that gdb unwind failed with read of invalid memory address
> when I used `DW_OP_addr` in my unwind info. Upon checking, it seems
> that the handling of this operation in the dwarf interpreter is very
> suspicious.
>
> The interpreter for the op code has a comment[1] sayijng,
>
>> Some versions of GCC emit DW_OP_addr before
>> DW_OP_GNU_push_tls_address. In this case the value is an
>> index, not an address.
>
> However, the code appears to check for exactly the opposite condition
> `op_ptr >= op_end || *op_ptr != DW_OP_GNU_push_tls_address` to decide
> whether the result should be used as index. This was added 12 years
> ago in commit ac56253ddece [2].
>
> Am I missing something or is this a long-standing bug?
My understanding is:
- normally, a value given by DW_OP_addr is an address that should be
relocated with the base address of the objfile
- the DW_OP_GNU_push_tls_address operation (now called
DW_OP_form_tls_address in DWARF 5) expects some kind of value on top
of the stack, identifying the TLS variable to fetch. It's
implementation-defined what this value means, but in practice it
means it's some value that should not be relocated.
- a contemporary version of GCC produces something like this for a TLS
variable's DW_AT_location:
DW_OP_const8u 0x4, DW_OP_form_tls_address
- A version of gcc in the past must have used this instead:
DW_OP_addr 0x4, DW_OP_form_tls_address
The usage of DW_OP_addr was wrong, and it made so GDB had to avoid
relocating the DW_OP_addr value in this particular case. So it is
checking, if we have DW_OP_addr followed by DW_OP_form_tls_address, then
we don't relocate, because we are in this buggy situation.
And so the condition:
if (op_ptr >= op_end || *op_ptr != DW_OP_GNU_push_tls_address)
result += this->m_per_objfile->objfile->text_section_offset ();
looks right to me. It says, only relocate if:
- DW_OP_addr is the last operation of the sequence
- the following op is not DW_OP_form_tls_address / DW_OP_GNU_push_tls_address
Simon
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Suspected bug in DW_OP_addr handling
2022-05-08 17:25 ` Simon Marchi
@ 2022-05-09 14:03 ` Yichao Yu
0 siblings, 0 replies; 3+ messages in thread
From: Yichao Yu @ 2022-05-09 14:03 UTC (permalink / raw)
To: Simon Marchi; +Cc: gdb
> My understanding is:
Thanks for the detailed explanation!
>
> - normally, a value given by DW_OP_addr is an address that should be
> relocated with the base address of the objfile
OK, this is my confusion I guess. I guess I wasn't sure what "address"
refers to in the dwarf spec.
I now see that dwarf spec has a section dedicated to relocation (7.3)
and it mentions that dw_op_addr should be relocated. I was previously
confused by the "constant address" in table 7.9 in 7.7.1 and assumed
that it is the full address.
The following then all makes sense.
> - the DW_OP_GNU_push_tls_address operation (now called
> DW_OP_form_tls_address in DWARF 5) expects some kind of value on top
> of the stack, identifying the TLS variable to fetch. It's
> implementation-defined what this value means, but in practice it
> means it's some value that should not be relocated.
> - a contemporary version of GCC produces something like this for a TLS
> variable's DW_AT_location:
>
> DW_OP_const8u 0x4, DW_OP_form_tls_address
>
> - A version of gcc in the past must have used this instead:
>
> DW_OP_addr 0x4, DW_OP_form_tls_address
>
> The usage of DW_OP_addr was wrong, and it made so GDB had to avoid
> relocating the DW_OP_addr value in this particular case. So it is
> checking, if we have DW_OP_addr followed by DW_OP_form_tls_address, then
> we don't relocate, because we are in this buggy situation.
>
> And so the condition:
>
> if (op_ptr >= op_end || *op_ptr != DW_OP_GNU_push_tls_address)
> result += this->m_per_objfile->objfile->text_section_offset ();
>
> looks right to me. It says, only relocate if:
>
> - DW_OP_addr is the last operation of the sequence
> - the following op is not DW_OP_form_tls_address / DW_OP_GNU_push_tls_address
>
> Simon
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-05-09 14:04 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-07 3:54 Suspected bug in DW_OP_addr handling Yichao Yu
2022-05-08 17:25 ` Simon Marchi
2022-05-09 14:03 ` Yichao Yu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).