https://bugs.kde.org/show_bug.cgi?id=522497
--- Comment #5 from [email protected] --- Hi Mark,(In reply to Mark Wielaard from comment #3) > [...] > Interesting. Do you happen to have a backtrace of where exactly this > invocation of the malloc ifunc resolver takes place? So maybe we do that > while it is unnecessary because we already intercept the malloc call (and > should then never call it directly) so things appear to work fine. I've tried to debug valgrind while it runs a program built with the Glibc patch mentioned above. I couldn't debug valgrind itself, but I managed to get the backtrace of the call to the ifunc resolver that has wrong argument passed to it: at 0x49A0F58: __bad_ifunc_call (malloc-ifuncs.c:31) by 0x49A0F93: malloc (malloc-ifuncs.c:34) by 0x487076F: _vgnU_ifunc_wrapper (vg_preloaded.c:130) by 0x4031037: elf_ifunc_invoke (dl-irel.h:57) by 0x4031037: elf_machine_rela (dl-machine.h:195) by 0x4031037: elf_dynamic_do_Rela_irelative (do-rel.h:228) by 0x4031037: _dl_relocate_object_no_relro (dl-reloc.c:294) by 0x4031ADB: _dl_relocate_object (dl-reloc.c:344) by 0x403F0AF: dl_main (rtld.c:2252) by 0x403AA0F: _dl_sysdep_start (dl-sysdep.c:140) by 0x403D90B: _dl_start_final (rtld.c:494) by 0x403D90B: _dl_start (rtld.c:579) by 0x40400D3: (below main) (dl-start.S:31) So, this looks like a normal call to a resolver that Glibc is doing itself except for the injected call to "_vgnU_ifunc_wrapper" that is part of the valgrind code. It appears that valgrind doesn't try to call an ifunc resolver itself. Rather, it intercepts a normal call that originates from Glibc. However, something happens in "_vgnU_ifunc_wrapper". The argument that the resolver "__libc_malloc_redirect_ifunc" receives is exactly the same as the argument that is passed to "elf_ifunc_invoke". This is wrong because argument of "elf_ifunc_invoke" is a symbol address, and when resolver is called from "elf_ifunc_invoke" it passes 2 other arguments (first is AT_HWCAP value with bit _IFUNC_ARG_HWCAP set). But in valgrind, the first argument passed to "elf_ifunc_invoke" is propagated to the resolver itself, which is wrong. If I run the same program via GDB I can see that "elf_ifunc_invoke" calls "__libc_malloc_redirect_ifunc" passing correct argument. When execution happens inside valgrind it is different. One small other things is that in the backtrace above ifunc resolver's name is shown as "malloc" while it should be "__libc_malloc_redirect_ifunc". The "malloc" symbol is an alias for the "__libc_malloc_redirect" (notice no "_ifunc" at the end) which has resolver attribute pointing to the resolver "__libc_malloc_redirect_ifunc". If you attach GDB to valgrind at this moment, you will see correct names in the backtrace shown by GDB: #0 __bad_ifunc_call (arg0=77205340) at ../sysdeps/aarch64/multiarch/malloc-ifuncs.c:31 #1 0x49a0f94 in __libc_malloc_redirect_ifunc (arg0=<optimized out>) at ../sysdeps/aarch64/multiarch/malloc-ifuncs.c:34 #2 0x4870770 in _vgnU_ifunc_wrapper () at vg_preloaded.c:130 #3 0x4031038 in elf_ifunc_invoke (addr=77205340) at ../sysdeps/aarch64/dl-irel.h:57 -- You are receiving this mail because: You are watching all bug changes.
