Re: [Libunwind-devel] unw_init_remote call results in SIGSEGV

Hey Arun,

On Tue, Apr 21, 2015 at 2:32 AM, Arun Prakash Jana <address@hidden> wrote:

Hi,

I am calling unw_create_addr_space() in the following lines:
--------------------------
/* Create address space for little endian */
addrspace = unw_create_addr_space(&accessors, 0);
if (!addrspace) {
fprintf(stderr, "unw_create_addr_space failed\n");
return -1;
}
--------------------------

You haven't initialised accessors with anything at this point. I think you are supposed to just pass in _UPT_accessors as per man page, but I haven't really ever used the ptrace support.

And I can verify from GDB that it is initialized:
--------------------------
(gdb) bt full
#0 0x0000000000000000 in ?? ()
No symbol table info available.
#1 0x00007ffff7bbeee4 in _Ux86_64_init_remote () from /usr/lib/x86_64-linux-gnu/libunwind-x86_64.so.8
No symbol table info available.
#2 0x0000000000400d8c in main (argc=2, argv=0x7fffffffe0e8) at unwind.c:87
addrspace = 0x603010
uptinfo = 0x60dab0
accessors = {find_proc_info = 0x7ffff7602c58, put_unwind_info = 0x1f25bc2, get_dyn_info_list_addr = 0x7fffffffdce0,
access_mem = 0x7ffff7de4991 <_dl_lookup_symbol_x+305>, access_reg = 0x0, access_fpreg = 0x7ffff7fe0a58, resume = 0x7ffff7fe1000,
get_proc_name = 0x7ffff7dda77c}

All of these addresses look to be junk and don't point to any procedures. So when the tracing code calls them as functions, you'll just jump to random memory addresses.

cursor = {opaque = {6347440, 6303760, 4294967296, 4294969506, 140737354127864, 140737488346688, 140737488346496, 140737354009176, 1, 0, 2,
1, 2, 2, 2, 3, 2, 4, 2, 5, 2, 6, 2, 7, 2, 8, 2, 9, 2, 10, 2, 11, 2, 12, 2, 13, 2, 14, 2, 15, 2, 16, 2, 140737354127864,
140737351887448, 7, 140737351885856, 140737351884800, 140737488346816, 140737351936639, 140733193388033, 0, 0, 140737351925404,
140737488346672, 1700966438, 0, 1, 0, 140737351927416, 0, 140737488346656, 140737354113376, 140737488346928, 140737354113496,
140737488346912, 0, 140737351925404, 0, 4131212846, 3, 8, 140737354007936, 140737351927830, 0, 140737488346768, 140737343610152,
140737488347040, 140737343660456, 64550200, 140737488347024, 140737354132200, 0, 140737354008048, 140737354010624, 4196003,
140737343663480, 4195176, 4294967296, 4294969392, 0, 140737488347224, 140737488347184, 140737354008048, 1, 140737354130720,
140737354129864, 140737351928209, 0, 140737354008048, 1, 0, 140733193388033, 140737354129864, 0, 0, 0, 0, 0, 140737354130720,
140737488347040, 140737488347024, 4131212846, 4196003, 4294967295, 140737488347392, 140737343660456, 140737354010624, 140737354129864,
0, 1, 4198109, 140737488347136, 0, 4198032, 4196864, 140737488347360}}
RIP = 140737354013160
RBP = 140737488346080
PID = 26450
ret = 26450
wait_loops = 18
wait_time = 1000
waitstatus = 4991
stopped = 1
(gdb)
--------------------------

Regards,

Arun

Cheers,
Lassi

On Tue, Apr 21, 2015 at 12:09 AM, Lassi Tuura <address@hidden> wrote:
It doesn't look like you are initialising your unw_accessors_t accessors. From libunwind-ptrace man page:

An application that wants to use the _UPT-facility first needs to create a new libunwind address-space that represents the target process. This is done by calling unw_create_addr_space(). In many cases, the application will simply want to pass the address of _UPT_accessors as the first argument to this routine

On Mon, Apr 20, 2015 at 1:42 PM, Arun Prakash Jana <address@hidden> wrote:
Hi,

I am writing a small test program to check how libunwind can be used to trace a remote program.

A call to unw_init_remote() throws SIGSEGV.

Relevant code snippet:
------------------
unw_addr_space_t addrspace;
struct UPT_info *uptinfo;
unw_accessors_t accessors;
unw_cursor_t cursor;
unw_word_t RIP, RBP;

pid_t PID = 1;
int ret = 0;

if (argc !=2) {
fprintf(stderr, "Usage: unwind PID\n");
return -1;
}

if ((PID = atoi(argv[1])) <= 0) {
fprintf(stderr, "Valid PID please!\n");
return -1;
}

fprintf(stdout, "Tracing PID: %d\n", PID);

/* Create address space for little endian */
addrspace = unw_create_addr_space(&accessors, 0);
if (!addrspace) {
fprintf(stderr, "unw_create_addr_space failed\n");
return -1;
}

uptinfo = (struct UPT_info *)_UPT_create(PID);
if (!uptinfo) {
fprintf(stderr, "_UPT_create failed\n");
goto bail;
}

ret = unw_init_remote(&cursor, addrspace, uptinfo);
if (ret < 0) {
fprintf(stderr, "unw_init_remote failed\n");
goto bail;
}
------------------

strace output:
------------------
> strace ./unwind 8423
execve("./unwind", ["./unwind", "8423"], [/* 85 vars */]) = 0
brk(0) = 0x1cdd000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cc9000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=81750, ...}) = 0
mmap(NULL, 81750, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fc136cb5000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64-linux-gnu/libunwind-x86_64.so.8", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\27\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=67608, ...}) = 0
mmap(NULL, 2223816, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc13688a000
mprotect(0x7fc13689a000, 2093056, PROT_NONE) = 0
mmap(0x7fc136a99000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xf000) = 0x7fc136a99000
mmap(0x7fc136a9b000, 57032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc136a9b000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64-linux-gnu/libunwind-ptrace.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0\17\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14528, ...}) = 0
mmap(NULL, 2109736, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc136686000
mprotect(0x7fc136689000, 2093056, PROT_NONE) = 0
mmap(0x7fc136888000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fc136888000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\37\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1840928, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cb4000
mmap(NULL, 3949248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc1362c1000
mprotect(0x7fc13647c000, 2093056, PROT_NONE) = 0
mmap(0x7fc13667b000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ba000) = 0x7fc13667b000
mmap(0x7fc136681000, 17088, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc136681000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/usr/lib/x86_64-linux-gnu/libunwind.so.8", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\37\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=51192, ...}) = 0
mmap(NULL, 2207464, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc1360a6000
mprotect(0x7fc1360b2000, 2093056, PROT_NONE) = 0
mmap(0x7fc1362b1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7fc1362b1000
mmap(0x7fc1362b3000, 57064, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fc1362b3000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/liblzma.so.5", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320 \0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=137400, ...}) = 0
mmap(NULL, 2232456, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc135e84000
mprotect(0x7fc135ea5000, 2093056, PROT_NONE) = 0
mmap(0x7fc1360a4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x20000) = 0x7fc1360a4000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\16\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14664, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cb3000
mmap(NULL, 2109744, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fc135c80000
mprotect(0x7fc135c83000, 2093056, PROT_NONE) = 0
mmap(0x7fc135e82000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7fc135e82000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cb2000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cb0000
arch_prctl(ARCH_SET_FS, 0x7fc136cb0780) = 0
mprotect(0x7fc13667b000, 16384, PROT_READ) = 0
mprotect(0x7fc135e82000, 4096, PROT_READ) = 0
mprotect(0x7fc1360a4000, 4096, PROT_READ) = 0
mprotect(0x7fc1362b1000, 4096, PROT_READ) = 0
mprotect(0x7fc136888000, 4096, PROT_READ) = 0
mprotect(0x7fc136a99000, 4096, PROT_READ) = 0
mprotect(0x601000, 4096, PROT_READ) = 0
mprotect(0x7fc136ccb000, 4096, PROT_READ) = 0
munmap(0x7fc136cb5000, 81750) = 0
fstat(1, {st_mode=S_IFREG|0664, st_size=5320, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cc8000
brk(0) = 0x1cdd000
brk(0x1d08000) = 0x1d08000
rt_sigprocmask(SIG_SETMASK, ~[RTMIN RT_1], [], 8) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cc7000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fc136cc6000
mincore(0x7ffd4ae65b3f, 1, 0x7ffd4ae65b3f) = -1 EINVAL (Invalid argument)
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0} ---
+++ killed by SIGSEGV +++
fish: Job 1, “strace ./unwind 8423 > strace.log 2>&1” terminated by signal SIGSEGV (Address boundary error)
------------------

I am on Ubuntu 14.04 (arch: x86_64). Can someone please explain what I'm doing wrong?

Regards,

Arun

_______________________________________________
Libunwind-devel mailing list
address@hidden
https://lists.nongnu.org/mailman/listinfo/libunwind-devel

From:	Lassi Tuura
Subject:	Re: [Libunwind-devel] unw_init_remote call results in SIGSEGV
Date:	Tue, 21 Apr 2015 18:00:11 +0200