[Bug translator/9883] New: static markers in userspace libraries segfaults

[Bug translator/9883] New: static markers in userspace libraries segfaults

[tralamazza at gmail dot com]

Systemtap fails to initialize and segfaults. It segfaults even if the library
was not compiled with markers. I tested both cases.

$ stap -e 'probe process("/lib64/libpthread.so.0").mark("*") { print("oi") }' -vvv
SystemTap translator/driver (version 0.9/0.140 commit a9c48361)
Copyright (C) 2005-2009 Red Hat, Inc. and others
This is free software; see the source for copying conditions.
Session arch: x86_64 release: 2.6.27.15-170.2.24.fc10.x86_64
Created temporary directory "/tmp/stapZD6V5W"
Searched '/home/tralamazza/local/share/systemtap/tapset/x86_64/*.stp', found 2
Searched '/home/tralamazza/local/share/systemtap/tapset/*.stp', found 46
Pass 1: parsed user script and 48 library script(s) in 200usr/10sys/222real ms.
parsed '*' -> func '*'
focused on module '/lib64/libpthread-2.9.so = [0x3051a00000-0x3051c1b370, bias
0x0] file /usr/lib/debug/lib64/libpthread-2.9.so.debug ELF machine x86_64 (code 62)
focused on module '/lib64/libpthread-2.9.so'
Segmentation fault


Inside gdb:
Program received signal SIGSEGV, Segmentation fault.
__libdw_find_attr (die=0x7fffffffa0e0, search_name=3, codep=0x7fffffffa120,
formp=0x7fffffffa124) at dwarf_child.c:73
73	  get_uleb128 (abbrev_code, readp);
Current language:  auto; currently c
(gdb) bt
#0  __libdw_find_attr (die=0x7fffffffa0e0, search_name=3, codep=0x7fffffffa120,
formp=0x7fffffffa124) at dwarf_child.c:73
#1  0x0000000000a19c5a in dwarf_attr (die=0x7fffffffa0e0, search_name=3,
result=0x7fffffffa120) at dwarf_attr.c:69
warning: (Internal error: pc 0x5d5e58 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x5d5e58 in read in psymtab, but not in symtab.)

#2  0x00000000005d5e59 in dwflpp::iterate_over_cu_labels (this=warning:
(Internal error: pc 0x5d5cb0 in read in psymtab, but not in symtab.)

warning: (Internal error: pc 0x5d5e58 in read in psymtab, but not in symtab.)

0x835c40, label_val=warning: (Internal error: pc 0x5d5e58 in read in psymtab,
but not in symtab.)


        {static npos = 18446744073709551615, _M_dataplus =
{<std::allocator<char>> = {<__gnu_cxx::new_allocator<char>> = {<No data
fields>}, <No data fields>}, _M_p = 0x836458 "_stapprobe1_*"}}, cu=warning:
(Internal error: pc 0x5d5e58 in read in psymtab, but not in symtab.)

0x7fffffffa2b0, data=0x7fffffffa6e0, 
    callback=0x5bc380 <query_statement>) at tapsets.cxx:1338
#3  0x00000000005bd1af in query_cu (cudie=<value optimized out>,
arg=0x7fffffffa6e0) at tapsets.cxx:4049
#4  0x00000000005bd5df in dwflpp::iterate_over_cus () at tapsets.cxx:1072
#5  dwarf_query::query_module_dwarf (this=0x7fffffffa6e0) at tapsets.cxx:3108
#6  0x00000000005bd858 in dwarf_query::handle_query_module (this=0x7fffffffa6e0)
at tapsets.cxx:3209
#7  0x00000000005aeb47 in query_module (mod=0x8359e0, name=0x836180
"/lib64/libpthread-2.9.so", addr=207527870464, arg=0x7fffffffa6e0) at
tapsets.cxx:4278
#8  0x0000000000a243e7 in dwfl_getmodules (dwfl=0x835e00, callback=0x5ae7f0
<query_module>, arg=0x7fffffffa6e0, offset=1) at dwfl_getmodules.c:103
#9  0x00000000005a0d6c in dwflpp::iterate_over_modules () at tapsets.cxx:1021
#10 dwflpp::query_modules (this=0x835c40, q=0x7fffffffa6e0) at tapsets.cxx:4297
#11 0x00000000005b4aa9 in dwarf_builder::build (this=0x835ef0,
sess=@0x7fffffffc430, base=0x8378d0, location=0x834cc0,
parameters=@0x7fffffffaa40, finished_results=@0x7fffffffbc20) at tapsets.cxx:5804
#12 0x000000000055b56c in match_node::find_and_build (this=0x7ffff5ed95c0,
s=@0x7fffffffc430, p=0x8378d0, loc=0x834cc0, pos=2, results=@0x7fffffffbc20) at
elaborate.cxx:334
#13 0x000000000055bfdb in match_node::find_and_build (this=0x7ffff5ed8ec0,
s=@0x7fffffffc430, p=0x8378d0, loc=0x834cc0, pos=1, results=@0x7fffffffbc20) at
elaborate.cxx:421
#14 0x000000000055bfdb in match_node::find_and_build (this=0x834880,
s=@0x7fffffffc430, p=0x8378d0, loc=0x834cc0, pos=0, results=@0x7fffffffbc20) at
elaborate.cxx:421
#15 0x000000000055c687 in derive_probes (s=@0x7fffffffc430, p=0x8378d0,
dps=@0x7fffffffbc20, optional=false) at elaborate.cxx:633
#16 0x000000000055eeca in semantic_pass_symbols () at elaborate.cxx:1119
#17 semantic_pass (s=@0x7fffffffc430) at elaborate.cxx:1413
#18 0x0000000000520fac in main (argc=2, argv=0x7fffffffe368) at main.cxx:984
(gdb) p readp 
$6 = (const unsigned char *) 0x700000055 <Address 0x700000055 out of bounds>
(gdb) p *die
$7 = {addr = 0x700000055, cu = 0x7ffff5daea3c, abbrev = 0x3, padding__ = 10593019}

-- 
           Summary: static markers in userspace libraries segfaults
           Product: systemtap
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: translator
        AssignedTo: systemtap at sources dot redhat dot com
        ReportedBy: tralamazza at gmail dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=9883

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

[Bug translator/9883] static markers in userspace libraries segfaults

[mjw at redhat dot com]

------- Additional Comments From mjw at redhat dot com  2009-02-23 16:57 -------
Seems, we forget to check whether the die has any children to begin with in
tapsets.cxx (iterate_over_cu_labels)

Testing following fix:

diff --git a/tapsets.cxx b/tapsets.cxx
index 78d5a5b..5d9d062 100644
--- a/tapsets.cxx
+++ b/tapsets.cxx
@@ -1330,7 +1330,10 @@ struct dwflpp
 
     const char * sym = label_val.c_str();
     Dwarf_Die die;
-    dwarf_child (cu, &die);
+    int res = dwarf_child (cu, &die);
+    if (res != 0)
+      return;  // die without children, bail out.
+
     static string function_name;
     do 
       {


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|systemtap at sources dot    |mjw at redhat dot com
                   |redhat dot com              |
             Status|NEW                         |ASSIGNED


http://sourceware.org/bugzilla/show_bug.cgi?id=9883

------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.