From: Jacob Kroon <jacob.kroon@gmail.com>
To: Florian Weimer <fweimer@redhat.com>
Cc: Jacob Kroon via Gdb <gdb@sourceware.org>
Subject: Re: Debugging ld.so in gdb
Date: Fri, 4 Feb 2022 17:53:27 +0100 [thread overview]
Message-ID: <f73d7ef6-7d2b-47c4-db0f-968608abcdd9@gmail.com> (raw)
In-Reply-To: <87h79eobq1.fsf@oldenburg.str.redhat.com>
On 2/4/22 17:09, Florian Weimer wrote:
> * Jacob Kroon:
>
>> On 2/4/22 15:22, Florian Weimer wrote:
>>> * Jacob Kroon:
>>>
>>>> This is what I get, following the instructions above:
>>>>
>>>>> 171966 0x00007ffff7fd85a0 <dfs_traversal+80>: mov 0x0(%r13),%rax
>>>>> 171967 0x00007ffff7fd85a4 <dfs_traversal+84>: lea -0x8(%rax),%rdx
>>>>> 171968 0x00007ffff7fd85a8 <dfs_traversal+88>: mov %rdx,0x0(%r13)
>>>>> 171969 0x00007ffff7fd85ac <dfs_traversal+92>: mov %rbp,-0x8(%rax)
>>>>> 171970 0x00007ffff7fd85b0 <dfs_traversal+96>: add $0x8,%rsp
>>>>> 171971 0x00007ffff7fd85b4 <dfs_traversal+100>: pop %rbx
>>>>> 171972 0x00007ffff7fd85b5 <dfs_traversal+101>: pop %rbp
>>>>> 171973 0x00007ffff7fd85b6 <dfs_traversal+102>: pop %r12
>>>>> 171974 0x00007ffff7fd85b8 <dfs_traversal+104>: pop %r13
>>>>> 171975 0x00007ffff7fd85ba <dfs_traversal+106>: ret
>>>>
>>>> Does that make sense ? Any other information I can provide. This is with
>>>> glibc-2.34-24.fc35.x86_64, Fedora 35.
>>>
>>> This doesn't really make sense. There's probably some GDB option to get
>>> a longer trace.
>>>
>>> If it is crashing at the RET, it means that either code has been mapped
>>> over, or the stack has been corrupted. At the crash site, what does
>>>
>>> print *(void**)$rsp
>>>
>>> print?
>>>
>>
>> $2 = (void *) 0x7ffff7d31b70
>>
>>> disassemble *(void**)$rsp
>>>
>>> could also be interesting.
>>>
>>
>> "No function contains specified address"
>>
>> Let me see if I can find some gdb option to get a longer trace.
>
> Looks like the code at that address has been unmapped (or the link map
> is at least gone from a GDB perspective). Maybe you can see what was at
> the address before using “info files”?
>
> Thanks,
> Florian
>
I couldn't see that address anywhere in the output of "show files".
But I did "full" recording, and found a place where just stepping a
single instruction broke gdb interpreting the backtrace, if that is of
any help. This is what I do:
1. goto instruction 225037
2. print backtrace (looks sane)
3. do "disas"
4. step one instruction with "stepi"
5. print backtrace (looks garbled)
6. do "disas"
> (gdb) record goto 225037
> Go backward to insn number 225037
> #0 dfs_traversal (rpo=rpo@entry=0x7fffffffd3b0, map=0x7ffff7fad590, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:175
> 175 **rpo = map;
> (gdb) bt
> #0 dfs_traversal (rpo=rpo@entry=0x7fffffffd3b0, map=0x7ffff7fad590, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:175
> #1 0x00007ffff7fd85d4 in dfs_traversal (do_reldeps=0x0, map=<optimized out>, rpo=0x7fffffffd3b0) at dl-sort-maps.c:143
> #2 dfs_traversal (rpo=rpo@entry=0x7fffffffd3b0, map=0x7ffff7fadb70, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:155
> #3 0x00007ffff7fd89cd in dfs_traversal (do_reldeps=0x0, map=<optimized out>, rpo=0x7fffffffd3b0) at dl-sort-maps.c:143
> #4 _dl_sort_maps_dfs (skip=<optimized out>, for_fini=<optimized out>, nmaps=15, maps=0x7ffff7953de0) at dl-sort-maps.c:233
> #5 _dl_sort_maps (maps=maps@entry=0x7ffff7953de0, nmaps=nmaps@entry=15, skip=<optimized out>, for_fini=for_fini@entry=false) at dl-sort-maps.c:299
> #6 0x00007ffff7fcaf0f in _dl_map_object_deps (map=<optimized out>, preloads=<optimized out>, npreloads=<optimized out>, trace_mode=<optimized out>, open_mode=<optimized out>)
> at dl-deps.c:616
> #7 0x00007ffff7fe6970 in dl_main (phdr=<optimized out>, phnum=<optimized out>, user_entry=<optimized out>, auxv=<optimized out>) at rtld.c:1968
> #8 0x00007ffff7fe2c7c in _dl_sysdep_start (start_argptr=<optimized out>, dl_main=0x7ffff7fe4bb0 <dl_main>) at ../elf/dl-sysdep.c:264
> #9 0x00007ffff7fe4678 in _dl_start_final (arg=0x7fffffffdf50) at rtld.c:493
> #10 _dl_start (arg=0x7fffffffdf50) at rtld.c:587
> #11 0x00007ffff7fe36a8 in _start ()
> (gdb) disas
> Dump of assembler code for function dfs_traversal:
> 0x00007ffff7fd8550 <+0>: push %r13
> 0x00007ffff7fd8552 <+2>: mov %rdi,%r13
> 0x00007ffff7fd8555 <+5>: push %r12
> 0x00007ffff7fd8557 <+7>: mov %rdx,%r12
> 0x00007ffff7fd855a <+10>: push %rbp
> 0x00007ffff7fd855b <+11>: mov %rsi,%rbp
> 0x00007ffff7fd855e <+14>: push %rbx
> 0x00007ffff7fd855f <+15>: sub $0x8,%rsp
> 0x00007ffff7fd8563 <+19>: mov 0x3d0(%rsi),%rax
> 0x00007ffff7fd856a <+26>: orb $0x1,0x31d(%rsi)
> 0x00007ffff7fd8571 <+33>: test %rax,%rax
> 0x00007ffff7fd8574 <+36>: je 0x7ffff7fd859b <dfs_traversal+75>
> 0x00007ffff7fd8576 <+38>: mov (%rax),%rsi
> 0x00007ffff7fd8579 <+41>: test %rsi,%rsi
> 0x00007ffff7fd857c <+44>: je 0x7ffff7fd859b <dfs_traversal+75>
> 0x00007ffff7fd857e <+46>: mov $0x8,%ebx
> 0x00007ffff7fd8583 <+51>: testw $0x180,0x31c(%rsi)
> 0x00007ffff7fd858c <+60>: je 0x7ffff7fd85c0 <dfs_traversal+112>
> 0x00007ffff7fd858e <+62>: mov (%rax,%rbx,1),%rsi
> 0x00007ffff7fd8592 <+66>: add $0x8,%rbx
> 0x00007ffff7fd8596 <+70>: test %rsi,%rsi
> 0x00007ffff7fd8599 <+73>: jne 0x7ffff7fd8583 <dfs_traversal+51>
> 0x00007ffff7fd859b <+75>: test %r12,%r12
> 0x00007ffff7fd859e <+78>: jne 0x7ffff7fd85e0 <dfs_traversal+144>
> 0x00007ffff7fd85a0 <+80>: mov 0x0(%r13),%rax
> 0x00007ffff7fd85a4 <+84>: lea -0x8(%rax),%rdx
> 0x00007ffff7fd85a8 <+88>: mov %rdx,0x0(%r13)
> => 0x00007ffff7fd85ac <+92>: mov %rbp,-0x8(%rax)
> 0x00007ffff7fd85b0 <+96>: add $0x8,%rsp
> 0x00007ffff7fd85b4 <+100>: pop %rbx
> 0x00007ffff7fd85b5 <+101>: pop %rbp
> 0x00007ffff7fd85b6 <+102>: pop %r12
> 0x00007ffff7fd85b8 <+104>: pop %r13
> 0x00007ffff7fd85ba <+106>: ret
> 0x00007ffff7fd85bb <+107>: nopl 0x0(%rax,%rax,1)
> 0x00007ffff7fd85c0 <+112>: testb $0x1,0x31d(%rsi)
> 0x00007ffff7fd85c7 <+119>: jne 0x7ffff7fd858e <dfs_traversal+62>
> 0x00007ffff7fd85c9 <+121>: mov %r12,%rdx
> 0x00007ffff7fd85cc <+124>: mov %r13,%rdi
> 0x00007ffff7fd85cf <+127>: call 0x7ffff7fd8550 <dfs_traversal>
> 0x00007ffff7fd85d4 <+132>: mov 0x3d0(%rbp),%rax
> 0x00007ffff7fd85db <+139>: jmp 0x7ffff7fd858e <dfs_traversal+62>
> 0x00007ffff7fd85dd <+141>: nopl (%rax)
> 0x00007ffff7fd85e0 <+144>: mov 0x3d8(%rbp),%rax
> 0x00007ffff7fd85e7 <+151>: test %rax,%rax
> 0x00007ffff7fd85ea <+154>: je 0x7ffff7fd85a0 <dfs_traversal+80>
> 0x00007ffff7fd85ec <+156>: mov (%rax),%ebx
> 0x00007ffff7fd85ee <+158>: movb $0x1,(%r12)
> 0x00007ffff7fd85f3 <+163>: sub $0x1,%ebx
> 0x00007ffff7fd85f6 <+166>: js 0x7ffff7fd85a0 <dfs_traversal+80>
> 0x00007ffff7fd85f8 <+168>: movslq %ebx,%rdx
> 0x00007ffff7fd85fb <+171>: mov 0x8(%rax,%rdx,8),%rsi
> 0x00007ffff7fd8600 <+176>: testw $0x180,0x31c(%rsi)
> 0x00007ffff7fd8609 <+185>: je 0x7ffff7fd8619 <dfs_traversal+201>
> 0x00007ffff7fd860b <+187>: sub $0x1,%ebx
> 0x00007ffff7fd860e <+190>: jb 0x7ffff7fd85a0 <dfs_traversal+80>
> 0x00007ffff7fd8610 <+192>: mov 0x3d8(%rbp),%rax
> 0x00007ffff7fd8617 <+199>: jmp 0x7ffff7fd85f8 <dfs_traversal+168>
> 0x00007ffff7fd8619 <+201>: testb $0x1,0x31d(%rsi)
> 0x00007ffff7fd8620 <+208>: jne 0x7ffff7fd860b <dfs_traversal+187>
> 0x00007ffff7fd8622 <+210>: mov %r12,%rdx
> 0x00007ffff7fd8625 <+213>: mov %r13,%rdi
> 0x00007ffff7fd8628 <+216>: call 0x7ffff7fd8550 <dfs_traversal>
> 0x00007ffff7fd862d <+221>: jmp 0x7ffff7fd860b <dfs_traversal+187>
> End of assembler dump.
> (gdb) stepi
> 0x00007ffff7fd85b0 176 }
> (gdb) bt
> #0 0x00007ffff7fd85b0 in dfs_traversal (rpo=rpo@entry=0x7fffffffd3b0, map=0x7ffff7fad590, do_reldeps=do_reldeps@entry=0x0) at dl-sort-maps.c:176
> #1 0x00007ffff7fd85d4 in dfs_traversal (do_reldeps=0x0, map=<optimized out>, rpo=0x7fffffffd3b0) at dl-sort-maps.c:143
> #2 dfs_traversal (rpo=0x7fffffffd3b0, map=0x7ffff7fadb70, do_reldeps=0x0) at dl-sort-maps.c:155
> #3 0x00007ffff7fad590 in ?? ()
> #4 0x00007ffff7d31b70 in ?? ()
> #5 0x00007ffff7d32830 in ?? ()
> #6 0x00007ffff7fae150 in ?? ()
> #7 0x00007ffff7fae730 in ?? ()
> #8 0x00007ffff7d32160 in ?? ()
> #9 0x00007ffff7952d30 in ?? ()
> #10 0x00007ffff79d1920 in ?? ()
> #11 0x00007ffff7d31000 in ?? ()
> #12 0x00007ffff79d1ef0 in ?? ()
> #13 0x00007ffff79d24c0 in ?? ()
> #14 0x00007ffff7952000 in ?? ()
> #15 0x00007ffff7952660 in ?? ()
> #16 0x00007ffff79537a0 in ?? ()
> #17 0x00007ffff7d31570 in ?? ()
> #18 0x00007ffff7ffda30 in _rtld_local ()
> #19 0x0000000000000001 in ?? ()
> #20 0xffffffffa5c00000 in ?? ()
> #21 0xffffeffc0b0e0000 in ?? ()
> #22 0x00007ffff795a409 in ?? ()
> #23 0x0000000000000000 in ?? ()
> (gdb) disas
> Dump of assembler code for function dfs_traversal:
> 0x00007ffff7fd8550 <+0>: push %r13
> 0x00007ffff7fd8552 <+2>: mov %rdi,%r13
> 0x00007ffff7fd8555 <+5>: push %r12
> 0x00007ffff7fd8557 <+7>: mov %rdx,%r12
> 0x00007ffff7fd855a <+10>: push %rbp
> 0x00007ffff7fd855b <+11>: mov %rsi,%rbp
> 0x00007ffff7fd855e <+14>: push %rbx
> 0x00007ffff7fd855f <+15>: sub $0x8,%rsp
> 0x00007ffff7fd8563 <+19>: mov 0x3d0(%rsi),%rax
> 0x00007ffff7fd856a <+26>: orb $0x1,0x31d(%rsi)
> 0x00007ffff7fd8571 <+33>: test %rax,%rax
> 0x00007ffff7fd8574 <+36>: je 0x7ffff7fd859b <dfs_traversal+75>
> 0x00007ffff7fd8576 <+38>: mov (%rax),%rsi
> 0x00007ffff7fd8579 <+41>: test %rsi,%rsi
> 0x00007ffff7fd857c <+44>: je 0x7ffff7fd859b <dfs_traversal+75>
> 0x00007ffff7fd857e <+46>: mov $0x8,%ebx
> 0x00007ffff7fd8583 <+51>: testw $0x180,0x31c(%rsi)
> 0x00007ffff7fd858c <+60>: je 0x7ffff7fd85c0 <dfs_traversal+112>
> 0x00007ffff7fd858e <+62>: mov (%rax,%rbx,1),%rsi
> 0x00007ffff7fd8592 <+66>: add $0x8,%rbx
> 0x00007ffff7fd8596 <+70>: test %rsi,%rsi
> 0x00007ffff7fd8599 <+73>: jne 0x7ffff7fd8583 <dfs_traversal+51>
> 0x00007ffff7fd859b <+75>: test %r12,%r12
> 0x00007ffff7fd859e <+78>: jne 0x7ffff7fd85e0 <dfs_traversal+144>
> 0x00007ffff7fd85a0 <+80>: mov 0x0(%r13),%rax
> 0x00007ffff7fd85a4 <+84>: lea -0x8(%rax),%rdx
> 0x00007ffff7fd85a8 <+88>: mov %rdx,0x0(%r13)
> 0x00007ffff7fd85ac <+92>: mov %rbp,-0x8(%rax)
> => 0x00007ffff7fd85b0 <+96>: add $0x8,%rsp
> 0x00007ffff7fd85b4 <+100>: pop %rbx
> 0x00007ffff7fd85b5 <+101>: pop %rbp
> 0x00007ffff7fd85b6 <+102>: pop %r12
> 0x00007ffff7fd85b8 <+104>: pop %r13
> 0x00007ffff7fd85ba <+106>: ret
> 0x00007ffff7fd85bb <+107>: nopl 0x0(%rax,%rax,1)
> 0x00007ffff7fd85c0 <+112>: testb $0x1,0x31d(%rsi)
> 0x00007ffff7fd85c7 <+119>: jne 0x7ffff7fd858e <dfs_traversal+62>
> 0x00007ffff7fd85c9 <+121>: mov %r12,%rdx
> 0x00007ffff7fd85cc <+124>: mov %r13,%rdi
> 0x00007ffff7fd85cf <+127>: call 0x7ffff7fd8550 <dfs_traversal>
> 0x00007ffff7fd85d4 <+132>: mov 0x3d0(%rbp),%rax
> 0x00007ffff7fd85db <+139>: jmp 0x7ffff7fd858e <dfs_traversal+62>
> 0x00007ffff7fd85dd <+141>: nopl (%rax)
> 0x00007ffff7fd85e0 <+144>: mov 0x3d8(%rbp),%rax
> 0x00007ffff7fd85e7 <+151>: test %rax,%rax
> 0x00007ffff7fd85ea <+154>: je 0x7ffff7fd85a0 <dfs_traversal+80>
> 0x00007ffff7fd85ec <+156>: mov (%rax),%ebx
> 0x00007ffff7fd85ee <+158>: movb $0x1,(%r12)
> 0x00007ffff7fd85f3 <+163>: sub $0x1,%ebx
> 0x00007ffff7fd85f6 <+166>: js 0x7ffff7fd85a0 <dfs_traversal+80>
> 0x00007ffff7fd85f8 <+168>: movslq %ebx,%rdx
> 0x00007ffff7fd85fb <+171>: mov 0x8(%rax,%rdx,8),%rsi
> 0x00007ffff7fd8600 <+176>: testw $0x180,0x31c(%rsi)
> 0x00007ffff7fd8609 <+185>: je 0x7ffff7fd8619 <dfs_traversal+201>
> 0x00007ffff7fd860b <+187>: sub $0x1,%ebx
> 0x00007ffff7fd860e <+190>: jb 0x7ffff7fd85a0 <dfs_traversal+80>
> 0x00007ffff7fd8610 <+192>: mov 0x3d8(%rbp),%rax
> 0x00007ffff7fd8617 <+199>: jmp 0x7ffff7fd85f8 <dfs_traversal+168>
> 0x00007ffff7fd8619 <+201>: testb $0x1,0x31d(%rsi)
> 0x00007ffff7fd8620 <+208>: jne 0x7ffff7fd860b <dfs_traversal+187>
> 0x00007ffff7fd8622 <+210>: mov %r12,%rdx
> 0x00007ffff7fd8625 <+213>: mov %r13,%rdi
> 0x00007ffff7fd8628 <+216>: call 0x7ffff7fd8550 <dfs_traversal>
> 0x00007ffff7fd862d <+221>: jmp 0x7ffff7fd860b <dfs_traversal+187>
> End of assembler dump.
/Jacob
next prev parent reply other threads:[~2022-02-04 16:53 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-04 13:45 Jacob Kroon
2022-02-04 13:58 ` Florian Weimer
2022-02-04 14:09 ` Jacob Kroon
2022-02-04 14:22 ` Florian Weimer
2022-02-04 14:27 ` Jacob Kroon
2022-02-04 16:09 ` Florian Weimer
2022-02-04 16:53 ` Jacob Kroon [this message]
2022-02-04 17:04 ` Florian Weimer
2022-02-04 17:11 ` Jacob Kroon
2022-02-04 17:15 ` Florian Weimer
2022-02-07 8:36 ` Jacob Kroon
2022-02-07 11:46 ` Jacob Kroon
2022-02-07 11:55 ` Florian Weimer
2022-02-07 12:15 ` Jacob Kroon
2022-02-07 12:27 ` Florian Weimer
2022-02-07 12:32 ` Jacob Kroon
2022-02-07 13:39 ` Jacob Kroon
2022-02-07 13:45 ` Jacob Kroon
2022-02-07 13:53 ` Adhemerval Zanella
2022-02-07 13:54 ` Jacob Kroon
2022-02-07 14:07 ` Florian Weimer
2022-02-07 16:28 ` Florian Weimer
2022-02-07 17:04 ` Jacob Kroon
2022-02-04 14:45 ` Jacob Kroon
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f73d7ef6-7d2b-47c4-db0f-968608abcdd9@gmail.com \
--to=jacob.kroon@gmail.com \
--cc=fweimer@redhat.com \
--cc=gdb@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).