[Bug gdb/34330] New: GDB does not resolve GNU ifunc in inferior

https://sourceware.org/bugzilla/show_bug.cgi?id=34330

            Bug ID: 34330
           Summary: GDB does not resolve GNU ifunc in inferior
           Product: gdb
           Version: HEAD
            Status: NEW
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: ykhrustalev at sourceware dot org
                CC: aburgess at redhat dot com, bauermann at sourceware dot org,
                    codonell at redhat dot com, muhammad.kamran at arm dot com,
                    simark at simark dot ca
  Target Milestone: ---

GDB uses some symbols from inferior internally, for example,
to evaluate an expression that involves calling a function
from inferior it would use malloc to allocate memory needed
to execute the function call. When these symbols are GNU
ifuncs, GDB may use the resolver as the symbol itself instead
of resolving the symbol properly which can lead to undefined
behaviour.

In 2.44 release Glibc introduced ifunc for malloc functions
on AArch64 (commit 9ed3576e61 [1]). This made the above issue
in GDB more prominent. Examples of how it manifests include:

1) (gdb) call printf("%s\n", "hello")
   Might result in SIGILL or SIGSEGV but if it works, it
   prints the format string instead of 'hello'.

2) foo.c:
   size_t foo (const char *a, const char *b)
   {
     return strlen(a) + strlen(b);
   }

   (gdb) print foo("123", "456789")
   Prints 6 instead of 9.

In both 1) and 2) cases above, functions 'printf' and 'foo' receive
the same address in both arguments.

3) (gdb) disassemble __libc_malloc
This will show different code at the start of the '__libc_malloc'
function before and after trying the examples from above. This shows
that doing something in GDB, such as evaluating an expression, that
requires using inferior's malloc, would corrupt code of the malloc
function itself.

This issue has been detected by Linaro CI and its original analysis
was done in [2].

The fix was proposed in [3] (v1), [4] (v2), and [5] (v3).

---

[1]: https://sourceware.org/git/?p=glibc.git;a=commit;h=9ed3576e61
[2]:
https://lists.linaro.org/archives/list/[email protected]/thread/JQPE6PDUXKZ24SBM6DC5LZTRC5HBQ7ZV/
[3]:
https://patchwork.sourceware.org/project/gdb/patch/[email protected]/
[4]:
https://patchwork.sourceware.org/project/gdb/patch/[email protected]/
[5]:
https://patchwork.sourceware.org/project/gdb/cover/[email protected]/

-- 
You are receiving this mail because:
You are on the CC list for the bug.