[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 8 Mar 2017 02:18:43 +0100
From: Szabolcs Nagy <nsz@...t70.net>
To: musl@...ts.openwall.com
Subject: Re: musl segfaulting when compiled with -O2
* Rich Felker <dalias@...c.org> [2017-03-07 16:45:40 -0500]:
> On Tue, Mar 07, 2017 at 05:55:29PM -0300, Breno Leitao wrote:
> > $ wget http://cdn-fastly.deb.debian.org/debian/pool/main/m/musl/musl_1.1.16-2_ppc64el.deb
> >
> > $ dpkg-deb -x musl_1.1.16-2_ppc64el.deb .
> >
> > $ lib/powerpc64le-linux-musl/libc.so
> > [2] 25672 segmentation fault (core dumped) lib/powerpc64le-linux-musl/libc.so
>
> Can you do a register dump and a dissassembly dump and around the
> point that crashes? The Debian package is fully stripped (lacks debug
> symbols) so it's hard to follow what it's doing, but I didn't see
> anything obviously wrong.
>
> Rich
i used qemu-ppc64le -singlestep -d in_asm,cpu to debug this
the relevant code is the end of _dlstart_c:
...
8c574: 09 00 00 48 bl 8c57c <writev+0x28c>
8c578: 28 98 fa ff fsub f31,f26,f19
8c57c: a6 02 48 7d mflr r10
8c580: 00 00 2a 81 lwz r9,0(r10)
8c584: 14 52 29 7d add r9,r9,r10
8c588: a6 03 29 7d mtctr r9
8c58c: 18 00 41 f8 std r2,24(r1)
8c590: 78 3b e4 7c mr r4,r7
8c594: 78 4b 2c 7d mr r12,r9
8c598: 21 04 80 4e bctrl
it's a pc relative address load and jump (to call __dls2):
bl 1f
data // data == 0xfffa9828
1: mflr r10 // r10 = &data == 0x8c57c
lwz r9,0(r10) // r9 = *r10 (== data)
add r9,r9,r10 // r9 += r10 (== 0xfffa9828+0x8c57c = 0x100035da0)
mtctr r9 // ctr = r9 (== 0x100035da0)
std r2,24(r1)
mr r4,r7
mr r12,r9
bctrl // ctr(r12,r4)
it seems __dls2 is at 0x35da0 so the pc relative data
should have been signextended.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
