[Bug libc/29635] New: Debian libc6: 2.35-1 breaks gdb on hppa

[Bug libc/29635] New: Debian libc6: 2.35-1 breaks gdb on hppa

[danglin at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29635

            Bug ID: 29635
           Summary: Debian libc6: 2.35-1 breaks gdb on hppa
           Product: glibc
           Version: 2.35
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: danglin at gcc dot gnu.org
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---
              Host: hppa*-*-linux*
            Target: hppa*-*-linux*
             Build: hppa*-*-linux*

dave@atlas:~$ gdb
Segmentation fault (core dumped)

Sep 26 22:04:36 mx3210 kernel: do_page_fault() command='gdb' type=6
address=0x4bc63f0b in libresolv.so.2[ea7f2000+e000]
Sep 26 22:04:36 mx3210 kernel: trap #6: Instruction TLB miss fault, vm_start =
0x0098b000, vm_end = 0x009c4000
Sep 26 22:04:36 mx3210 kernel: command line: gdb
Sep 26 22:04:36 mx3210 kernel: CPU: 0 PID: 7976 Comm: gdb Not tainted 5.19.11+
#1
Sep 26 22:04:36 mx3210 kernel: Hardware name: 9000/800/rp3440
Sep 26 22:04:36 mx3210 kernel:
Sep 26 22:04:36 mx3210 kernel:     YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
Sep 26 22:04:36 mx3210 kernel: PSW: 00000000000001101111111100001111 Not
tainted
Sep 26 22:04:36 mx3210 kernel: r00-03  000000ff0006ff0f 000000000014a908
00000000006b5537 0000000000000154
Sep 26 22:04:36 mx3210 kernel: r04-07  00000000f2e59fd4 00000000f4e396c8
00000000009562d0 00000000f4e1176c
Sep 26 22:04:36 mx3210 kernel: r08-11  00000000f4e117dc 0000000000000000
0000000000000000 00000000ffffffff
Sep 26 22:04:36 mx3210 kernel: r12-15  0000000000000000 0000000000177730
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel: r16-19  0000000000000001 000000000013c41c
000000000016e870 000000004bc53f11
Sep 26 22:04:36 mx3210 kernel: r20-23  00000000009562d0 000000004bc63f09
000000000014add8 0000000000000000
Sep 26 22:04:36 mx3210 kernel: r24-27  00000000f4e117dc 00000000f4e1176c
0000000000000154 0000000000135108
Sep 26 22:04:36 mx3210 kernel: r28-31  0000000000000000 0000000000000001
00000000f98e24c0 0000000000011234
Sep 26 22:04:36 mx3210 kernel: sr00-03  0000000000957400 0000000000000000
0000000000000000 0000000000957400
Sep 26 22:04:36 mx3210 kernel: sr04-07  0000000000957400 0000000000957400
0000000000957400 0000000000957400
Sep 26 22:04:36 mx3210 kernel:
Sep 26 22:04:36 mx3210 kernel:      VZOUICununcqcqcqcqcqcrmunTDVZOUI
Sep 26 22:04:36 mx3210 kernel: FPSR: 00000000000000000000000000000000
Sep 26 22:04:36 mx3210 kernel: FPER1: 00000000
Sep 26 22:04:36 mx3210 kernel: fr00-03  0000000000000000 0000000000000000
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel: fr04-07  0000000000000000 0000000000000000
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel: fr08-11  0000000000000000 0000000000000000
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel: fr12-15  0000000000000000 0000000000000000
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel: fr16-19  0000000000000000 0000000000000000
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel: fr20-23  0000000000000000 0000000000000000
006b5500009562d0 0000000000000000
Sep 26 22:04:36 mx3210 kernel: fr24-27  0000000000000000 0000000000000000
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel: fr28-31  0000000000000000 0000000000000000
0000000000000000 0000000000000000
Sep 26 22:04:36 mx3210 kernel:
Sep 26 22:04:36 mx3210 kernel: IASQ: 0000000000957400 0000000000957400 IAOQ:
000000004bc63f0b 000000004bc63f0f
Sep 26 22:04:36 mx3210 kernel: IIR: 43ffff80    ISR: 0000000000957400  IOR:
000000000014add8
Sep 26 22:04:36 mx3210 kernel: CPU:        0   CR30: 00000040d6db4570 CR31:
ffffffffffffefff
Sep 26 22:04:36 mx3210 kernel: ORIG_R28: 0000000000000000
Sep 26 22:04:36 mx3210 kernel: IAOQ[0]: 000000004bc63f0b
Sep 26 22:04:36 mx3210 kernel: IAOQ[1]: 000000004bc63f0f
Sep 26 22:04:36 mx3210 kernel: RP(r2): 00000000006b5537

   104c4:       43 ff ff 80     ldb 1fc0(sr3,r31),r31

I found that I can run it using /lib/ld.so.1:

dave@atlas:~/gnu/gdb/objdir$ /lib/ld.so.1 /usr/bin/gdb -c core /usr/bin/gdb
GNU gdb (Debian 12.1-3) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "hppa-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/gdb...
Reading symbols from
/usr/lib/debug/.build-id/26/0797847dd13b287f99df369368a8a943c3d2f3.debug...
[New LWP 3873]
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/home/dave/gnu/glibc/objdir/nptl_db/libthread_db.so.1".
Core was generated by `gdb'.
--Type <RET> for more, q to quit, c to continue without paging--
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x4bc63f08 in ?? ()
(gdb) directory /home/dave/debian/glibc/glibc-2.35/elf
Source directories searched: /home/dave/debian/glibc/glibc-2.35/elf:$cdir:$cwd
(gdb) bt
#0  0x4bc63f08 in ?? ()
#1  0x006b5534 in operator new (sz=340)
    at /build/gdb-2W62n4/gdb-12.1/gdbsupport/new-op.cc:59
#2  0xf2ae4c00 in boost::basic_regex<char, boost::regex_traits<char,
boost::cpp_regex_traits<char> > >::do_assign(char const*, char const*, unsigned
int) ()
   from /lib/hppa-linux-gnu/libboost_regex.so.1.74.0
#3  0xf4a98434 in ?? () from /lib/hppa-linux-gnu/libsource-highlight.so.4
#4  0xf773ae50 in call_init (env=0xf4b2f7dc, argv=0xf4b2f76c, argc=9790160,
    l=<optimized out>) at dl-init.c:70
#5  call_init (l=<optimized out>, argc=9790160, argv=0xf4b2f76c,
    env=0xf4b2f7dc) at dl-init.c:26
#6  0xf773af88 in _dl_init (main_map=0xf4b574c8, argc=-189597732, argv=0x0,
    env=0x9562d0) at dl-init.c:117
#7  0xf7750f9c in _dl_start_user () from /lib/ld.so.1
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) frame 4
#4  0xf773ae50 in call_init (env=0xf4b2f7dc, argv=0xf4b2f76c, argc=9790160,
    l=<optimized out>) at dl-init.c:70
70              ((dl_init_t) addrs[j]) (argc, argv, env);
(gdb) p j
$1 = <optimized out>
(gdb) list
65
66            jm = l->l_info[DT_INIT_ARRAYSZ]->d_un.d_val / sizeof
(ElfW(Addr));
67
68            addrs = (ElfW(Addr) *) (init_array->d_un.d_ptr + l->l_addr);
69            for (j = 0; j < jm; ++j)
70              ((dl_init_t) addrs[j]) (argc, argv, env);
71          }
72      }
73
74
(gdb) disass $pc-32,$pc+16
Dump of assembler code from 0xf773ae30 to 0xf773ae60:
   0xf773ae30 <call_init+244>:  shladd,l r5,2,r3,r5
   0xf773ae34 <call_init+248>:  ldw 0(r3),r22
   0xf773ae38 <call_init+252>:  copy r19,r4
   0xf773ae3c <call_init+256>:  copy r8,r24
   0xf773ae40 <call_init+260>:  copy r7,r25
   0xf773ae44 <call_init+264>:  copy r6,r26
   0xf773ae48 <call_init+268>:  b,l 0xf775a9c4 <$$dyncall>,r31
   0xf773ae4c <call_init+272>:  copy r31,rp
=> 0xf773ae50 <call_init+276>:  ldo 4(r3),r3
   0xf773ae54 <call_init+280>:  cmpb,<> r3,r5,0xf773ae34 <call_init+248>
   0xf773ae58 <call_init+284>:  copy r4,r19
   0xf773ae5c <call_init+288>:  ldw -94(sp),rp
End of assembler dump.
(gdb) frame 4
#4  0xf773ae50 in call_init (env=0xf4b2f7dc, argv=0xf4b2f76c, argc=9790160,
    l=<optimized out>) at dl-init.c:70
70              ((dl_init_t) addrs[j]) (argc, argv, env);
(gdb) p/x $r22
$3 = 0x14add8
(gdb) x/2x 0x14add8
0x14add8 <coff_locate_sections(bfd*, asection*, void*)+192>:    0x4bc63f09    
0x4bc53f11
(gdb) disass $pc-32,$pc+16
Dump of assembler code from 0xf773ae30 to 0xf773ae60:
   0xf773ae30 <call_init+244>:  shladd,l r5,2,r3,r5
   0xf773ae34 <call_init+248>:  ldw 0(r3),r22
   0xf773ae38 <call_init+252>:  copy r19,r4
   0xf773ae3c <call_init+256>:  copy r8,r24
   0xf773ae40 <call_init+260>:  copy r7,r25
   0xf773ae44 <call_init+264>:  copy r6,r26
   0xf773ae48 <call_init+268>:  b,l 0xf775a9c4 <$$dyncall>,r31
   0xf773ae4c <call_init+272>:  copy r31,rp
=> 0xf773ae50 <call_init+276>:  ldo 4(r3),r3
   0xf773ae54 <call_init+280>:  cmpb,<> r3,r5,0xf773ae34 <call_init+248>
   0xf773ae58 <call_init+284>:  copy r4,r19
   0xf773ae5c <call_init+288>:  ldw -94(sp),rp
End of assembler dump.
(gdb) x/x $r3
0x154:  Cannot access memory at address 0x154

There is a problem running array initializers that wasn't present in 2.34.
Gdb runs okay if I revert to 2.34-8.

Not sure what changes when I run the interpreter first.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/29635] Debian libc6: 2.35-1 breaks gdb on hppa

[danglin at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29635

--- Comment #1 from John David Anglin <danglin at gcc dot gnu.org> ---
Updated backtrace:

(gdb) c
Continuing.
warning: Unable to find libthread_db matching inferior's thread library, thread
debugging will not be available.

Breakpoint 10, 0x006b5500 in ?? ()
(gdb) bt
#0  0x006b5500 in ?? ()
#1  0xf5498c00 in boost::basic_regex<char, boost::regex_traits<char,
boost::cpp_regex_traits<char> > >::do_assign (this=0xf710b6c8
<srchilite::datadir_exp>,
    p1=0xf70e376c
"[[:blank:]]*(datadir)[[:blank:]]*=[[:blank:]]*\"([^[:blank:]\\r]+)\"[[:blank:]\\r]*|([[:space:]]+)|([[:space:]]*#.*)",
p2=0xf70e37dc "",
    f=0) at ./boost/regex/v4/basic_regex.hpp:671
#2  0xf704c434 in boost::basic_regex<char, boost::regex_traits<char,
boost::cpp_regex_traits<char> > >::assign (f=0, p2=0xf70e37dc "",
    p1=0xf70e376c
"[[:blank:]]*(datadir)[[:blank:]]*=[[:blank:]]*\"([^[:blank:]\\r]+)\"[[:blank:]\\r]*|([[:space:]]+)|([[:space:]]*#.*)",
    this=0xf710b6c8 <srchilite::datadir_exp>)
    at /usr/include/boost/regex/v4/basic_regex.hpp:394
#3  boost::basic_regex<char, boost::regex_traits<char,
boost::cpp_regex_traits<char> > >::assign (f=0,
    p=0xf70e376c
"[[:blank:]]*(datadir)[[:blank:]]*=[[:blank:]]*\"([^[:blank:]\\r]+)\"[[:blank:]\\r]*|([[:space:]]+)|([[:space:]]*#.*)",
    this=0xf710b6c8 <srchilite::datadir_exp>)
    at /usr/include/boost/regex/v4/basic_regex.hpp:383
#4  boost::basic_regex<char, boost::regex_traits<char,
boost::cpp_regex_traits<char> > >::basic_regex (f=0,
    p=0xf70e376c
"[[:blank:]]*(datadir)[[:blank:]]*=[[:blank:]]*\"([^[:blank:]\\r]+)\"[[:blank:]\\r]*|([[:space:]]+)|([[:space:]]*#.*)",
    this=0xf710b6c8 <srchilite::datadir_exp>)
    at /usr/include/boost/regex/v4/basic_regex.hpp:352
#5  __static_initialization_and_destruction_0 (__initialize_p=1,
    __priority=65535) at settings.cpp:52
#6  _GLOBAL__sub_I_settings.cpp(void) () at settings.cpp:200
#7  0xf96f5e50 in call_init (env=0xf70e37dc, argv=0xf70e376c, argc=0,
    l=<optimized out>) at dl-init.c:70
#8  call_init (l=<optimized out>, argc=0, argv=0xf70e376c, env=0xf70e37dc)
    at dl-init.c:26
#9  0xf96f5f88 in _dl_init (main_map=0xf710b4c8, argc=-150063140, argv=0x0,
    env=0x0) at dl-init.c:117
#10 0xf970bf9c in _dl_start_user () from /lib/ld.so.1
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

The boost initialization has called _Znwj@@Base in gdb.

006b5500 <_Znwj@@Base>:
  6b5500:       6b c2 3f d9     stw rp,-14(sp)
  6b5504:       37 de 01 00     ldo 80(sp),sp
  6b5508:       6b c6 3f 19     stw r6,-74(sp)
  6b550c:       08 13 02 46     copy r19,r6
  6b5510:       6b c3 3f 31     stw r3,-68(sp)
  6b5514:       34 03 00 02     ldi 1,r3
  6b5518:       6b d3 3f c1     stw r19,-20(sp)
  6b551c:       08 7a 88 80     cmpclr,<< r26,r3,r0
  6b5520:       08 1a 02 43     copy r26,r3
  6b5524:       6b c5 3f 21     stw r5,-70(sp)
  6b5528:       6b c4 3f 29     stw r4,-6c(sp)
  6b552c:       e8 43 0d 98     b,l 6bbc00 <_ZdaPvj@@Base+0x64a4>,rp
  6b5530:       08 03 02 5a     copy r3,r26
  6b5534:       c8 bc 20 38     movb,= ret0,r5,6b5558 <_Znwj@@Base+0x58>
  6b5538:       08 06 02 53     copy r6,r19
  6b553c:       4b c2 3e d9     ldw -94(sp),rp
  6b5540:       4b c6 3f 19     ldw -74(sp),r6
  6b5544:       4b c5 3f 21     ldw -70(sp),r5
  6b5548:       4b c4 3f 29     ldw -6c(sp),r4
  6b554c:       4b c3 3f 31     ldw -68(sp),r3
  6b5550:       e8 40 c0 00     bv r0(rp)
  6b5554:       37 de 3f 01     ldo -80(sp),sp

The long branch stub for the call at 6b552c is:

Dump of assembler code from 0x6bbc00 to 0x6bbc18:
=> 0x006bbc00:  addil L%15800,dp,r1
   0x006bbc04:  ldo 4d0(r1),r22
   0x006bbc08:  ldw 0(r22),r21
   0x006bbc0c:  bv r0(r21)
   0x006bbc10:  ldw 4(r22),r19
   0x006bbc14:  addil L%15000,dp,r1
End of assembler dump.

At 0x006bbc0c, we have:

(gdb) p/x $r21
$17 = 0x81c0259
(gdb) x/2x $r22
0x146dd8:       0x081c0259      0xe85b1779

It seems elf_machine_runtime_setup() has not yet been called for the main
executable, so register dp and likely the PLT is not yet setup.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/29635] Debian libc6: 2.35-1 breaks gdb on hppa

[danglin at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=29635

John David Anglin <danglin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #2 from John David Anglin <danglin at gcc dot gnu.org> ---
Fixed by commit d1d8379bff34f02f86f82db2cef5bf66746d3560.

-- 
You are receiving this mail because:
You are on the CC list for the bug.