Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 7 Mar 2017 21:28:27 -0500
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: musl segfaulting when compiled with -O2

On Wed, Mar 08, 2017 at 02:18:43AM +0100, Szabolcs Nagy wrote:
> * Rich Felker <dalias@...c.org> [2017-03-07 16:45:40 -0500]:
> > On Tue, Mar 07, 2017 at 05:55:29PM -0300, Breno Leitao wrote:
> > >   $ wget http://cdn-fastly.deb.debian.org/debian/pool/main/m/musl/musl_1.1.16-2_ppc64el.deb
> > > 
> > >   $ dpkg-deb -x musl_1.1.16-2_ppc64el.deb .
> > > 
> > >   $ lib/powerpc64le-linux-musl/libc.so 
> > > [2]    25672 segmentation fault (core dumped) lib/powerpc64le-linux-musl/libc.so
> > 
> > Can you do a register dump and a dissassembly dump and around the
> > point that crashes? The Debian package is fully stripped (lacks debug
> > symbols) so it's hard to follow what it's doing, but I didn't see
> > anything obviously wrong.
> > 
> > Rich
> 
> i used qemu-ppc64le -singlestep -d in_asm,cpu to debug this
> 
> the relevant code is the end of _dlstart_c:
> ....
>    8c574:       09 00 00 48     bl      8c57c <writev+0x28c>
>    8c578:       28 98 fa ff     fsub    f31,f26,f19
>    8c57c:       a6 02 48 7d     mflr    r10
>    8c580:       00 00 2a 81     lwz     r9,0(r10)
>    8c584:       14 52 29 7d     add     r9,r9,r10
>    8c588:       a6 03 29 7d     mtctr   r9
>    8c58c:       18 00 41 f8     std     r2,24(r1)
>    8c590:       78 3b e4 7c     mr      r4,r7
>    8c594:       78 4b 2c 7d     mr      r12,r9
>    8c598:       21 04 80 4e     bctrl
> 
> it's a pc relative address load and jump (to call __dls2):
> 
>    bl 1f
>    data          // data == 0xfffa9828
> 1: mflr r10      // r10 = &data == 0x8c57c
>    lwz r9,0(r10) // r9 = *r10 (== data)
>    add r9,r9,r10 // r9 += r10 (== 0xfffa9828+0x8c57c = 0x100035da0)
>    mtctr r9      // ctr = r9 (== 0x100035da0)
>    std r2,24(r1)
>    mr r4,r7
>    mr r12,r9
>    bctrl         // ctr(r12,r4)
> 
> it seems __dls2 is at 0x35da0 so the pc relative data
> should have been signextended.

Does the attached patch fix it?

Rich

View attachment "ppc64_crash.diff" of type "text/plain" (358 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.