Re: [PATCH] Handle absence of DT_DEBUG while debugging ld.so

[Luis Machado <luisgpm at linux dot vnet dot ibm dot com>]

On Mon, 2008-07-28 at 23:57 -0300, Luis Machado wrote:
> On Mon, 2008-07-28 at 22:27 -0400, Daniel Jacobowitz wrote:
> > On Mon, Jul 28, 2008 at 08:54:37PM -0300, Luis Machado wrote:
> > > Hi folks,
> > > 
> > > When trying to debug ld.so, we may find that the DT_DEBUG entry in
> > > the .dynamic section is missing, thus GDB tries to look for the _r_debug
> > > minimal symbol, and eventually finds it. This works OK as long as the
> > > _r_debug minimal symbol is correct and initialized.
> > > 
> > > In the case where GDB fetches an uninitialized _r_debug minimal symbol
> > > and tries to access its address, we have a memory access error, just
> > > like below:
> > > 
> > > (gdb) r
> > > Starting program: /foo/lib/ld.so.1
> > > Cannot access memory at address 0x2f648
> > > 
> > > Thus, we should guard this piece of code against uninitialized addresses
> > > so that GDB can skip this entry and look for another (hopefully) valid
> > > _r_debug symbol.
> > 
> > I think this is a PIE-related problem.  It has nothing to do with
> > uninitialized, because we're just taking the symbol's
> > address; but the address you've got there looks wrong.  It's as if
> > ld.so was loaded at 0x0.  How did that happen?
> 
> Yes, this specific address seems broken somehow. This is the first
> _r_debug entry GDB gets:
> 
> $6 = {ginfo = {name = 0x10a10b70 "_r_debug", value = {ivalue = 194116,
> block = 0x2f644, bytes = 0x2f644 <Address 0x2f644 out of bounds>,
>       address = 194116, chain = 0x2f644}, language_specific =
> {cplus_specific = {demangled_name = 0x0}}, language = language_auto,
>     section = 20, bfd_section = 0x109ea688}, info = 0x0, size = 20,
> filename = 0x10a09fe0 "rawmemchr.c", type = mst_bss, hash_next = 0x0,
>   demangled_hash_next = 0x0}
> 
> And this is the next _r_debug minimal symbol entry GDB gets:
> 
> $7 = {ginfo = {name = 0x10a10b70 "_r_debug", value = {ivalue =
> 134411844, block = 0x802f644,
>       bytes = 0x802f644 <Address 0x802f644 out of bounds>, address =
> 134411844, chain = 0x802f644}, language_specific = {cplus_specific = {
>         demangled_name = 0x0}}, language = language_auto, section = 20,
> bfd_section = 0x109ea688}, info = 0x0, size = 20,
>   filename = 0x10a09fe0 "rawmemchr.c", type = mst_bss, hash_next = 0x0,
> demangled_hash_next = 0x0}
> 
> Now, i see the very same offset there, but now looks like it has been
> shifted to a different address (ld's load address probably).
> 
> So, that's why i was imagining it wasn't really initialized yet.
> 
> Regards,
> Luis

btw, to reproduce it, just load ld.so into gdb and "run". You should see
the problem.

Luis