From: Florian Weimer <fweimer@redhat.com>
To: Jakub Jelinek <jakub@redhat.com>
Cc: Nathan Sidwell <nathan@acm.org>, GCC <gcc@gcc.gnu.org>,
GNU C Library <libc-alpha@sourceware.org>,
Binutils <binutils@sourceware.org>,
gnu-gabi@sourceware.org
Subject: Re: Invalid program counters and unwinding
Date: Mon, 01 Jan 2018 00:00:00 -0000 [thread overview]
Message-ID: <94c0c9cd-ab66-959a-fe46-9b14d3b8dfca@redhat.com> (raw)
In-Reply-To: <20180626112544.GP7166@tucnak>
On 06/26/2018 01:25 PM, Jakub Jelinek wrote:
> On Tue, Jun 26, 2018 at 01:01:06PM +0200, Florian Weimer wrote:
>> On 06/26/2018 12:56 PM, Nathan Sidwell wrote:
>>> On 06/26/2018 05:26 AM, Florian Weimer wrote:
>>>
>>>> So it looks to me that the caller of _Unwind_Find_FDE needs to
>>>> ensure that the PC is a valid element of the call stack. Is this a
>>>> correct assumption?
>>>
>>> I thought this was an (implicit?) requirement. You're unwinding a stack
>>> to deliver an exception up it. Are there use cases where that is not
>>> the case?
>>
>> We have something approaching this scenario.
>>
>> pthread_cancel in glibc unwinds the stack using DWARF information until
>> encounters a frame without unwind information, when it switches to longjmp
>> to get past that obstacle.
>>
>> However, at the point of transition from a valid DWARF frame into the
>> wilderness (without unwind data), we should still have accurate information
>> on the caller's PC, so _Unwind_Find_FDE will reliably fail to find any
>> unwind data for it. It's not a random pointer somewhere else, so I think
>> even the pthread_cancel case is fully supported.
>
> The usual ways to get bogus PCs in the frames is:
> 1) stack corruption
> 2) setcontext/swapcontext with uninitialized or corrupted ucontext_t
> 3) bogus unwind info (compiler or linker etc. bug)
But if that happens, all bets are off, and we could still get a crash
with the current implementation.
And any approach which does not inhibit concurrent dlclose will only
make things worse if there are such concurrent calls, which is perhaps
an unusual combination.
> At least for unwinding, I think we don't and shouldn't care, we assume only
> valid programs. For cases like _Unwind_Backtrace when used to print info in
> case of fatal signal or stack corruption, it is more questionable, but at
> least the current implmentation doesn't care either.
At least glibc no longer tries to print a backtrace from a corrupted stack.
Thanks,
Florian
next prev parent reply other threads:[~2018-06-26 11:31 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-01 0:00 Florian Weimer
2018-01-01 0:00 ` Nathan Sidwell
2018-01-01 0:00 ` Florian Weimer
2018-01-01 0:00 ` Jakub Jelinek
2018-01-01 0:00 ` Florian Weimer [this message]
2018-01-01 0:00 ` Nathan Sidwell
2018-01-01 0:00 ` Florian Weimer
2018-01-01 0:00 ` Nathan Sidwell
2018-01-01 0:00 ` Florian Weimer
2018-01-01 0:00 ` Nathan Sidwell
2018-01-01 0:00 ` Jakub Jelinek
2018-01-01 0:00 ` Jeff Law
2018-01-01 0:00 ` Florian Weimer
2018-01-01 0:00 ` Jeff Law
2018-01-01 0:00 ` Michael Matz
2018-01-01 0:00 ` Jakub Jelinek
2018-01-01 0:00 ` Michael Matz
2018-01-01 0:00 ` Florian Weimer
2018-01-01 0:00 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=94c0c9cd-ab66-959a-fe46-9b14d3b8dfca@redhat.com \
--to=fweimer@redhat.com \
--cc=binutils@sourceware.org \
--cc=gcc@gcc.gnu.org \
--cc=gnu-gabi@sourceware.org \
--cc=jakub@redhat.com \
--cc=libc-alpha@sourceware.org \
--cc=nathan@acm.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).