Bug 27205 - [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)
Summary: [-m32] FAIL: gdb.base/longjmp.exp: next over longjmp(1)
Status: RESOLVED FIXED
Alias: None
Product: gdb
Classification: Unclassified
Component: breakpoints (show other bugs)
Version: HEAD
: P2 normal
Target Milestone: 11.1
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-01-19 15:51 UTC by Tom de Vries
Modified: 2021-01-28 10:02 UTC (History)
0 users

See Also:
Host:
Target:
Build:
Last reconfirmed:


Attachments
Tentative patch (1.60 KB, patch)
2021-01-23 09:50 UTC, Tom de Vries
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Tom de Vries 2021-01-19 15:51:25 UTC
On openSUSE Factory I see with target board unix/-m32:
...
(gdb) PASS: gdb.base/longjmp.exp: next to longjmp (1)
next^M
Warning:^M
Cannot insert breakpoint 0.^M
Cannot access memory at address 0xcfb589ee^M
^M
__libc_siglongjmp (env=0x804c040 <env>, val=1) at ../setjmp/longjmp.c:30^M
30      }^M
(gdb) FAIL: gdb.base/longjmp.exp: next over longjmp(1)
...
Comment 1 Tom de Vries 2021-01-23 06:38:40 UTC
The failure to access memory is due to glibc having pointer encryption (aka "pointer mangling" or "pointer guard") of the long jump buffer.

So, when we're trying to read pc from the long jump buffer in i386_get_longjmp_target, we get an encrypted pointer, and don't decrypt it.  This issue has been known for a bit, see https://sourceware.org/legacy-ml/gdb-patches/2008-04/msg00127.html.

Possibly error mode could be improved: if we can detect that pc is not in a text segment or displaced stepping buffer, we return 0 in i386_get_longjmp_target, and revert to single stepping.

Anyway, the reason we're exercising i386_get_longjmp_target is that this fails:
...

          /* If we set the longjmp breakpoint via a SystemTap probe,                                                      
             then use it to extract the arguments.  The destination PC                                                    
             is the third argument to the probe.  */
          arg_value = probe_safe_evaluate_at_pc (frame, 2);
...
I double checked on openSUSE Leap 15.2 and there this works, so I'll try to figure out what's the difference.
Comment 2 Tom de Vries 2021-01-23 09:02:31 UTC
This could be the longjmp version of PR26881.

We install both master longjmp breakpoints using probe, and longjmp_names, in case libc debug info package is installed. 

For -m64, the probe one trigger first, and everything is handled properly.  With -m32, the longjump_names one triggers first, and we run into the encrypted pc problem.
Comment 3 Tom de Vries 2021-01-23 09:30:14 UTC
After installing glibc debug info for m32 on openSUSE Leap, I got the same, so the problem is reproducible with both glibc 2.26 and 2.32.
Comment 4 Tom de Vries 2021-01-23 09:50:30 UTC
Created attachment 13148 [details]
Tentative patch

Tentative patch, fixes failure.

Similar to fix for master exception breakpoint in 1940319c0ef "[gdb] Fix internal-error in process_event_stop_test" .
Comment 5 Tom de Vries 2021-01-27 14:31:51 UTC
Patch submitted: https://sourceware.org/pipermail/gdb-patches/2021-January/175503.html
Comment 6 Sourceware Commits 2021-01-28 09:59:46 UTC
The master branch has been updated by Tom de Vries <vries@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=2a7f6487d0a2f9a5f16d0f67904ac35100313eb1

commit 2a7f6487d0a2f9a5f16d0f67904ac35100313eb1
Author: Tom de Vries <tdevries@suse.de>
Date:   Thu Jan 28 10:59:42 2021 +0100

    [gdb/breakpoints] Fix longjmp master breakpoint with separate debug info
    
    When running test-case gdb.base/longjmp.exp with target board unix/-m32, we
    run into:
    ...
    (gdb) next^M
    Warning:^M
    Cannot insert breakpoint 0.^M
    Cannot access memory at address 0x7dbf7353^M
    ^M
    __libc_siglongjmp (env=0x804a040 <env>, val=1) at longjmp.c:28^M
    28        longjmps++;^M
    (gdb) FAIL: gdb.base/longjmp.exp: next over longjmp(1)
    ...
    
    The failure to access memory happens in i386_get_longjmp_target and is due to
    glibc having pointer encryption (aka "pointer mangling" or "pointer guard") of
    the long jump buffer.  This is a known problem.
    
    In create_longjmp_master_breakpoint (which attempts to install a master
    longjmp breakpoint) a preference scheme is present, which installs a
    probe breakpoint if a libc:longjmp probe is present, and otherwise falls back
    to setting breakpoints at the names in the longjmp_names array.
    
    But in fact, both the probe breakpoint and the longjmp_names breakpoints are
    set.  The latter ones are set when processing libc.so.debug, and the former
    one when processing libc.so.  In other words, this is the longjmp variant of
    PR26881, which describes the same problem for master exception breakpoints.
    
    This problem only triggers when the glibc debug info package is installed,
    which is not due to the debug info itself in libc.so.debug, but due to the
    minimal symbols (because create_longjmp_master_breakpoint uses minimal symbols
    to translate the longjmp_names to addresses).
    
    The problem doesn't trigger for -m64, because there tdep->jb_pc_offset is not
    set.
    
    Fix this similar to commit 1940319c0ef (the fix for PR26881): only install
    longjmp_names breakpoints in libc.so/libc.so.debug if installing the
    libc:longjmp probe in libc.so failed.
    
    Tested on x86_64-linux.
    
    gdb/ChangeLog:
    
    2021-01-28  Tom de Vries  <tdevries@suse.de>
    
            PR breakpoints/27205
            * breakpoint.c (create_longjmp_master_breakpoint_probe)
            (create_longjmp_master_breakpoint_names): New function, factored out
            of ...
            (create_longjmp_master_breakpoint): ... here.  Only try to install
            longjmp_names breakpoints in libc.so/libc.so.debug if installing probe
            breakpoint in libc.so failed.
Comment 7 Tom de Vries 2021-01-28 10:02:15 UTC
Patch committed, marking resolved-fixed.