https://bugs.kde.org/show_bug.cgi?id=528036
Bug ID: 528036
Summary: arm-linux: memset redirected to the memrchr
replacement (main .symtab read twice since lazy
debuginfo reading)
Classification: Developer tools
Product: valgrind
Version First 3.27 GIT
Reported In:
Platform: Compiled Sources
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Since 3.22.0 Memcheck on armhf can redirect a function to the replacement of
the preceding one. With glibc
(master 20313cef40 plus a patch series that only changes malloc/arena.c) built
by gcc 13.3 for
arm-linux-gnueabihf, memrchr (Thumb, st_value 0x6e87d, st_size 164) ends where
memset (ARM, 0x6e920,
sysdeps/arm/memset.S) starts. Every call to memset then runs the memrchr
replacement; glibc's
elf/tst-valgrind-smoke fails with:
Conditional jump or move depends on uninitialised value(s)
at 0x483CFC4: memrchr (vg_replace_strmem.c:1039)
by 0x4904B97: fstatat64_time64_statx (fstatat64.c:55)
by 0x4904B97: __fstatat64_time64 (fstatat64.c:150)
by 0x48AF3CF: _IO_file_doallocate (filedoalloc.c:74)
-v --trace-redir=yes shows the bogus active redirections:
0x048ce87d (memrchr ) R-> (2036.0) 0x0483cf8c memrchr
0x048ce920 (memrchr ) R-> (2036.0) 0x0483cf8c memrchr
0x048ce921 (memset ) R-> (2021.0) 0x048400ac memset
REDIR: 0x48ce920 (libc.so.6:memrchr) redirected to 0x483cf8c (memrchr)
Reproduced with 3.22.0 (Ubuntu 24.04), 3.24.0 (Debian 13) and master 492dde29d,
on an arm64 kernel in 32-bit
mode (armv8l). The double read was introduced with lazy debuginfo reading
(60f7e89ba, 3.22.0).
Cause: ML_(read_elf_object) reads the main image's .symtab and
canonicaliseSymtab trims memrchr to 163 bytes
(its odd Thumb address makes [avma, avma+size) overlap memset by one byte).
ML_(read_elf_debug) later reads the
same .symtab again and the table is canonicalised a second time; the 163- and
164-byte copies of memrchr do not
merge, and resolving that overlap leaves a one-byte "memrchr" at memset's
address and memset one byte later.
Depending on the symbol order the boundary byte can instead go to the other
side, and memset then loses its
redirection.
The attached patch reads the symbol table in ML_(read_elf_debug) only when it
comes from the debug image. With
it the smoke test passes (10/10), memset is redirected to the memset
replacement, and the regression tests
give the same results as unpatched master on armhf (none, helgrind, drd,
cachegrind, callgrind, massif, dhat,
lackey, exp-bbv, gdbserver_tests; memcheck partially, under QEMU emulation).
--
You are receiving this mail because:
You are watching all bug changes.
