CRASH (linux loading private library)

[derekbruening]

From [email protected] on June 07, 2011 14:45:23

split from issue #480 comment 4:

on Ubuntu 10.04 w/ the private loader we hit a SIGSEGV here:

#0 0x00007f0bc1200b28 in __strcasecmp (s1=0x72000f43 "libstdc++.so.6", s2=0x2fe229a92f <Address 0x2fe229a92f out of bounds>) at strcasecmp.c:65
#1 0x00000000711dd1bf in privload_lookup (name=0x72000f43 "libstdc++.so.6") at /home/username/DR/core/loader_shared.c:273
#2 0x00000000712a15a8 in privload_process_imports (mod=0x4157fb38) at /home/username/DR/core/linux/loader.c:462
#3 0x00000000711ddd2e in privload_load_finalize (privmod=0x4157fb38) at /home/username/DR/core/loader_shared.c:499
#4 0x00000000711dcddc in loader_init () at /home/username/DR/core/loader_shared.c:119
#5 0x00000000710805ab in dynamorio_app_init () at /home/username/DR/core/dynamo.c:496
#6 0x00007f0bc20d0b00 in _init () at /home/username/DR/core/linux/preload.c:186
#7 0x00007f0bc22e5d25 in call_init (main_map=0x7f0bc24f8128, argc=1, argv=0x7fffe229ba78, env=0x7fffe229ba88) at dl-init.c:70
#8 _dl_init (main_map=0x7f0bc24f8128, argc=1, argv=0x7fffe229ba78, env=0x7fffe229ba88) at dl-init.c:134
#9 0x00007f0bc22d7b2a in _dl_start_user () from /lib64/ld-linux-x86-64.so.2
#10 0x0000000000000001 in ?? ()

basically we've had to revert to pre-private-loader to get this C++ client to work

Original issue: http://code.google.com/p/dynamorio/issues/detail?id=489

[derekbruening]

From [email protected] on June 07, 2011 12:04:13

this crash is reproducible with any client not built with this flag:
-Wl,-soname,libmemcpp.so

=> has no DT_SONAME without it.

% objdump -p api/samples/bin/libmemcpp.so | grep -i soname
% <recompile w/ the -soname>
% objdump -p api/samples/bin/libmemcpp.so | grep -i soname
SONAME libmemcpp.so

(gdb) p *mod
$1 = {base = 0x72000000 "\177ELF\002\001\001", size = 2117632,
name = 0x2f87a9c82f <Address 0x2f87a9c82f out of bounds>,
path = "/home/bruening/dr/build_withwiki/api/samples/bin/libmemcpp.so", '\000' <repeats 198 times>, ref_count = 1, externally_loaded = 0, next = 0x7307f680, prev = 0x0,
os_privmod_data = 0x7307fd38}

when using cmake the flag is added automatically. this client was custom-built.

Cc: [email protected]

[derekbruening]

From [email protected] on June 07, 2011 13:03:09

So it seems the problem is because of the mis-compilation not private loader.
Not having DT_SONAME, DR does not know that libmemcpp.so is needed, and so cannot resolve symbols imported from libmemcpp.so.
If libmemcpp.so is used by the app, the pre-private-loader DR with client will works fine but not DR with private loader.

[derekbruening]

From [email protected] on June 07, 2011 13:34:46

nothing imports from libmemcpp.so. therefore DT_SONAME is optional and not needed. DT_SONAME is not required in a DSO. this library is a client, so DR is told where it is as a runtime parameter.

the private loader should at the least not crash mysteriously: else anyone not using cmake will think DR is completely broken b/c the simplest client crashes it. if there's some reason you can't support a client without a DT_SONAME, there should be a usage error. but I don't see any reason why you need DT_SONAME for the client?

[derekbruening]

From [email protected] on June 07, 2011 20:12:50

Attached is a simple fix, can you try if it works?

Attachment: i489.patch

[derekbruening]

From [email protected] on June 08, 2011 02:32:08

still crashes comparing NULL. I think your patch misses the privload_modlist_initialized() is true case.

you can test yourself by "make VERBOSE=1", take the two commands to build memtrace (or any other sample, really), remove the -Wl,-soname,* arg, and re-run those commands manually.

(gdb) up 1
#1 0x00000000711dd1fa in privload_lookup (name=0x72000fee "libdynamorio.so.3.0")
at /home/bruening/dr/withwiki/trunk/core/loader_shared.c:281
281 if (strcasecmp(name, mod->name) == 0)
(gdb) p *mod
$1 = {base = 0x72000000 "\177ELF\002\001\001", size = 2117632, name = 0x0,
path = "/home/bruening/dr/build_withwiki/api/samples/bin/libmemcpp.so", '\000' <repeats 198 times>, ref_count = 1, externally_loaded = 0, next = 0x41a77680, prev = 0x0,
os_privmod_data = 0x41a77d38}

[derekbruening]

From [email protected] on July 03, 2011 02:02:55

fixed by r855

[derekbruening]

From [email protected] on July 03, 2011 02:03:21

Status: Fixed