[Bug libc/30106] New: backtrace overwrites other memory

[Bug libc/30106] New: backtrace overwrites other memory

[vitiral at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30106

            Bug ID: 30106
           Summary: backtrace overwrites other memory
           Product: glibc
           Version: 2.36
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: vitiral at gmail dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Created attachment 14669
  --> https://sourceware.org/bugzilla/attachment.cgi?id=14669&action=edit
make output

I am using the backtrace() function and it seems to be overwriting memory I
didn't give it. The value in a different region of memory changes after
executing the below code:

  void* m[100] = {0};
  size_t len = backtrace(m, 100);

Note: I am using -m32 (32 bit)


In the below logs, addrOver is the address that is getting overwritten, trace
is the value being sent to backtrace. You can see that before and after are
changing.

??? Kern_handleSig addrOver=94A7444
??? Kern_handleSig trace   =FFEB3D18
??? Kern_handleSig before  =94A4FC8
??? Kern_handleSig after   =94A754C

# Command to build
git clone git@github.com:civboot/fngi.git
git clone git@github.com:civboot/civc.git
git clone git@github.com:civboot/cxt.git 
git clone git@github.com:civboot/zoa.git 
cd fngi
git checkout branch origin/gccBug
make &> /tmp/make.txt

make.txt is attached. The top of it reads:


Using built-in specs.      
COLLECT_GCC=gcc     
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/12/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:amdgcn-amdhsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 12.2.0-10'
--with-bugurl=file:///usr/share/doc/gcc-12/README.Bugs
--enable-languages=c,ada,c++,go,d,fortran,objc,obj-c++,m2 --prefix=/usr
--with-gcc-
major-version-only --program-suffix=-12 --program-prefix=x86_64-linux-gnu-
--enable-shared --enable-linker-build-id --libexecdir=/usr/lib
--without-included-gettext --enable-threads=posix --libdir=/usr/lib --enab
le-nls --enable-clocale=gnu --enable-libstdcxx-debug
--enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new
--enable-gnu-unique-object --disable-vtable-verify --enable-plugin
--enable-default-pie --with-sys
tem-zlib --enable-libphobos-checking=release --with-target-system-zlib=auto
--enable-objc-gc=auto --enable-multiarch --disable-werror --enable-cet
--with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,m
x32 --enable-multilib --with-tune=generic
--enable-offload-targets=nvptx-none=/build/gcc-12-hWCYKv/gcc-12-12.2.0/debian/tmp-nvptx/usr,amdgcn-amdhsa=/build/gcc-12-hWCYKv/gcc-12-12.2.0/debian/tmp-gcn/usr
--enable-o
ffload-defaulted --without-cuda-driver --enable-checking=release
--build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix 
Supported LTO compression algorithms: zlib zstd
gcc version 12.2.0 (Debian 12.2.0-10) 
COLLECT_GCC_OPTIONS='-v' '-save-temps' '-m32' '-no-pie' '-g' '-rdynamic'
'-Wall' '-Wno-pointer-sign' '-Wformat=0' '-I' '../civc' '-o' 'bin/tests'
'-mtune=generic' '-march=i686' '-dumpdir' 'bin/tests-'
 /usr/lib/gcc/x86_64-linux-gnu/12/cc1 -E -quiet -v -I ../civc -imultilib 32
-imultiarch i386-linux-gnu ../civc/civ/civ.c -m32 -mtune=generic -march=i686
-Wall -Wno-pointer-sign -Wformat=0 -g -fworking-directory -
fpch-preprocess -fasynchronous-unwind-tables -o bin/tests-civ.i

Note: I previously opened this as
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108746

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/30106] backtrace overwrites other memory

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30106

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |fweimer at redhat dot com
   Last reconfirmed|                            |2023-02-10
             Status|UNCONFIRMED                 |WAITING

--- Comment #1 from Florian Weimer <fweimer at redhat dot com> ---
Please provide a smaller reproducer. It's also not clear how you have set up
your 32-bit build environment.

You can also set a hardware watchpoint using GDB and get a backtrace at the
point the variable is overwritten.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/30106] backtrace overwrites other memory

[vmlinuz386 at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30106

Gerardo Exequiel Pozzi <vmlinuz386 at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |vmlinuz386 at gmail dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/30106] backtrace overwrites other memory

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=30106

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/30106] backtrace overwrites other memory

[vitiral at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=30106

Garrett vitiral <vitiral at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|---                         |INVALID

--- Comment #2 from Garrett vitiral <vitiral at gmail dot com> ---
I hit another similar bug with my program. This is likely my fault, sorry for
the noise.

I'm just learning gdb and memory watch. If somehow I'm wrong, I'll re-open this
with better details in the future.

-- 
You are receiving this mail because:
You are on the CC list for the bug.