Bug 24935 - Reading userland static data always leads to read faults on Fedora 29 x86_64
Summary: Reading userland static data always leads to read faults on Fedora 29 x86_64
Status: RESOLVED NOTABUG
Alias: None
Product: systemtap
Classification: Unclassified
Component: runtime (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-08-24 01:13 UTC by agentzh
Modified: 2024-04-10 21:25 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description agentzh 2019-08-24 01:13:06 UTC
I've noted that reading userland C static data always fails with read faults (-14) on Fedora 29 x86_64. Below is a minimal example that can demonstrate this issue:

File test.c:

    static const char *s = "hi";

    int main(void) {
        return 0;
    }

File test.stp:

    probe process.function("main") {
        printf("s = %s\n", user_string(@var("s")));
    }

And then compile the test.c C program:

    gcc -g test.c

And then run the test.stp script:

    $ stap test.stp -c './a.out'
    ERROR: user string copy fault -14 at 00000000a25ef291 [man error::fault] near identifier 'user_string_n' at /opt/stap/share/systemtap/tapset/uconversions.stp:114:10
    WARNING: Number of errors: 1, skipped probes: 0
    WARNING: /opt/stap/bin/staprun exited with status: 1
    Pass 5: run failed.  [man error::pass5]

I'm using the latest stap master branch (commit 8ffab23ff4):

    $ /opt/stap/bin/stap -V
    Systemtap translator/driver (version 4.2/0.176, commit release-4.1-72-g8ffab23ff4a1)
    Copyright (C) 2005-2019 Red Hat, Inc. and others
    This is free software; see the source for copying conditions.
    tested kernel versions: 2.6.18 ... 5.1-rc2
    enabled features: AVAHI BPF PYTHON2 LIBSQLITE3 LIBXML2 NLS NSS READLINE

The system is Fedora 29:

    $ cat /etc/redhat-release
    Fedora release 29 (Twenty Nine)


More info:

    $ gcc --version
    gcc (GCC) 8.3.1 20190223 (Red Hat 8.3.1-2)
    Copyright (C) 2018 Free Software Foundation, Inc.
    This is free software; see the source for copying conditions.  There is NO
    warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

    $ uname -a
    Linux glass 5.1.20-200.fc29.x86_64 #1 SMP Fri Jul 26 15:15:46 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

The same test example works flawlessly on CentOS 7:

    $ stap -c './a.out' test.stp
    s = hi

Using gcc options -fpic -pie to compile the test.c program makes no difference:

    ERROR: user string copy fault -14 at 000000004e89a066 [man error::fault] near identifier 'user_string_n' at /opt/stap/share/systemtap/tapset/uconversions.stp:114:10
    WARNING: Number of errors: 1, skipped probes: 0
    WARNING: /opt/stap/bin/staprun exited with status: 1
    Pass 5: run failed.  [man error::pass5]
Comment 1 William Cohen 2024-04-10 21:25:15 UTC
One could have the probe fire after the static string has been accessed by test.c, for example in the process("function").return for a function that accesses s. However, in this test.c example for this PR nothing is going to ever going to cause a page fault to pull in that static page that s points at.

Systemtap can only access pages that are already mapped in.  SystemTap can't trigger a pagefault to map in a page that is not currently mapped in. A similar situation was observed on a number of the testsuite/systemtap.syscall tests where a string was stored on a page that was not mapped in on syscall entry and the syscall would page fault the string in.  The work around in the syscall tests was to use mlockall(MCL_CURRENT) to ensure that the string in .rodata section was mapped in.  One example fix of this is git commit e67e4b19fd73953fbc8a23c91ae22f9d35a7c817:

Author: William Cohen <wcohen@redhat.com>  2023-11-15 17:01:14
Committer: William Cohen <wcohen@redhat.com>  2023-11-15 17:01:14
Parent: 114de05acfdab36295c9c6beee9715e986810d11 (PR29076: Additional syscall test fixes for .rodata on x86_64)
Child:  130af146398ca5788be92d258eabe1cee662037f (Tweak testsuite/semok/target_addr.stp to work with linux 5.14 and newer.)
Branches: master, remotes/origin/master, remotes/origin/mcermak-pr30321, wcohen/nfs
Follows: release-5.0a
Precedes: 

    PR29076: syscall test fixes for .rodata on x86_64 for pwritev.c and sysfs.c