[PATCH 0/2] Work around GDB bug overwriting __libc_malloc

[Florian Weimer]

This is a workaround for a GDB bug where it overwrites __libc_malloc
(yes, the code) with user-supplied string literals during inferior
function call evaluation.

  [PATCH v3 0/2] gdb: Fix internal inferior calls through GNU IFUNCs
  <https://inbox.sourceware.org/gdb-patches/20260629153203.10142-1-muhammad.kamran@arm.com>

It works by recognizing on-stack and AT_ENTRY trampoline call sites in
the malloc IFUNC resolver.  If a call by GDB is detect, malloc is
invoked directly from the IFUNC resolver (returning a heap pointer),
instead of returning the __libc_malloc address.

An alternative approach would involve a flag in the TCB that is set and
cleared around the IFUNC resolver call.  It's perhaps cleaner, but it
adds a tiny overhead to every IFUNC resolution.

We could also special-case malloc and redirect its resolution without
the IFUNC mechanism.  However, I expect this requires that the
implementation that GDB sees through the symbol tables remains
sufficiently compatible with the one selected via the IFUNC-like
mechanism (unless GDB reads non-IFUNC symbol values from relocations,
too, which I doubt).

I fear we need something like this if we want to switch to IFUNCs for
malloc any time soon because we don't control the pace at which users
update their GDB version.

Thanks,
Florian

Florian Weimer (2):
  elf: Record original entry point in GLRO(dl_entry)
  aarch64: Add workaround for GDB bug handling string literals

 elf/rtld.c                                |  1 +
 sysdeps/aarch64/multiarch/malloc-ifuncs.c | 60 +++++++++++++++++------
 sysdeps/generic/ldsodefs.h                |  4 ++
 3 files changed, 51 insertions(+), 14 deletions(-)


base-commit: ccd4cd5324caaaea1bb12bc8cef073170da51a19
-- 
2.54.0