Re: Debugging ld.so in gdb

[Jacob Kroon <jacob.kroon@gmail.com>]

Hi Florian,

On 2/4/22 14:58, Florian Weimer wrote:
> * Jacob Kroon via Gdb:
> 
>> Since a week or two I have started to see a segfault on my updated
>> Fedora 35 system. I suspect the segfault is related to a recent glibc
>> update.
>>
>> The segfault I see happens when I run the following:
>>
>> $ ldd ./mylib.so
>>
>> I narrowed it down to running:
>>
>> $ LD_TRACE_LOADED_OBJECTS=1 /lib64/ld-linux-x86-64.so.2 ./mylib.so
>>
>> "coredumpctl info" gives me:
>>
>>> Stack trace of thread 143567:
>>> #0  0x00007ff428f73590 n/a (n/a + 0x0)
>>> #1  0x00007ff428f8af0f _dl_map_object_deps (/usr/lib64/ld-linux-x86-64.so.2 + 0x3f0f)
>>> #2  0x00007ff428fa6970 dl_main (/usr/lib64/ld-linux-x86-64.so.2 + 0x1f970)
>>> #3  0x00007ff428fa2c7c _dl_sysdep_start (/usr/lib64/ld-linux-x86-64.so.2 + 0x1bc7c)
>>> #4  0x00007ff428fa4678 _dl_start_final (/usr/lib64/ld-linux-x86-64.so.2 + 0x1d678)
>>> #5  0x00007ff428fa36a8 _start (/usr/lib64/ld-linux-x86-64.so.2 + 0x1c6a8)
>>
>> but inspecting in gdb using "coredumpctl debug" doesn't give me any sane
>> backtrace.
>>
>> The .so is part of a Yocto build. If I copy the file out from its build
>> directory to $HOME and run ldd on it, then there is no crash. So I
>> suspect RUNPATH is involved somehow since it contains $ORIGIN.
>>
>> Any ideas of what I can do to investigate further ?
> 
> I suggest to run ld.so under GDB, with
> 
>   set startup-with-shell off
>   set environment LD_TRACE_LOADED_OBJECTS 1
>   b _start
>   run ./mylib.so
>   record btrace pt
>   continue
> 
> And after the crash, look at
> 
>   record instruction-history
> 
> to see how it reached the crash.  This assumes that you have an
> execution environment that supports branch tracing.
> 

This is what I get, following the instructions above:

> 171966	   0x00007ffff7fd85a0 <dfs_traversal+80>:	mov    0x0(%r13),%rax
> 171967	   0x00007ffff7fd85a4 <dfs_traversal+84>:	lea    -0x8(%rax),%rdx
> 171968	   0x00007ffff7fd85a8 <dfs_traversal+88>:	mov    %rdx,0x0(%r13)
> 171969	   0x00007ffff7fd85ac <dfs_traversal+92>:	mov    %rbp,-0x8(%rax)
> 171970	   0x00007ffff7fd85b0 <dfs_traversal+96>:	add    $0x8,%rsp
> 171971	   0x00007ffff7fd85b4 <dfs_traversal+100>:	pop    %rbx
> 171972	   0x00007ffff7fd85b5 <dfs_traversal+101>:	pop    %rbp
> 171973	   0x00007ffff7fd85b6 <dfs_traversal+102>:	pop    %r12
> 171974	   0x00007ffff7fd85b8 <dfs_traversal+104>:	pop    %r13
> 171975	   0x00007ffff7fd85ba <dfs_traversal+106>:	ret    

Does that make sense ? Any other information I can provide. This is with
glibc-2.34-24.fc35.x86_64, Fedora 35.

Regards Jacob