Re: [PATCH] Handle absence of DT_DEBUG while debugging ld.so

[Luis Machado <luisgpm@linux.vnet.ibm.com>]

On Mon, 2008-07-28 at 22:27 -0400, Daniel Jacobowitz wrote:
> On Mon, Jul 28, 2008 at 08:54:37PM -0300, Luis Machado wrote:
> > Hi folks,
> > 
> > When trying to debug ld.so, we may find that the DT_DEBUG entry in
> > the .dynamic section is missing, thus GDB tries to look for the _r_debug
> > minimal symbol, and eventually finds it. This works OK as long as the
> > _r_debug minimal symbol is correct and initialized.
> > 
> > In the case where GDB fetches an uninitialized _r_debug minimal symbol
> > and tries to access its address, we have a memory access error, just
> > like below:
> > 
> > (gdb) r
> > Starting program: /foo/lib/ld.so.1
> > Cannot access memory at address 0x2f648
> > 
> > Thus, we should guard this piece of code against uninitialized addresses
> > so that GDB can skip this entry and look for another (hopefully) valid
> > _r_debug symbol.
> 
> I think this is a PIE-related problem.  It has nothing to do with
> uninitialized, because we're just taking the symbol's
> address; but the address you've got there looks wrong.  It's as if
> ld.so was loaded at 0x0.  How did that happen?

Yes, this specific address seems broken somehow. This is the first
_r_debug entry GDB gets:

$6 = {ginfo = {name = 0x10a10b70 "_r_debug", value = {ivalue = 194116,
block = 0x2f644, bytes = 0x2f644 <Address 0x2f644 out of bounds>,
      address = 194116, chain = 0x2f644}, language_specific =
{cplus_specific = {demangled_name = 0x0}}, language = language_auto,
    section = 20, bfd_section = 0x109ea688}, info = 0x0, size = 20,
filename = 0x10a09fe0 "rawmemchr.c", type = mst_bss, hash_next = 0x0,
  demangled_hash_next = 0x0}

And this is the next _r_debug minimal symbol entry GDB gets:

$7 = {ginfo = {name = 0x10a10b70 "_r_debug", value = {ivalue =
134411844, block = 0x802f644,
      bytes = 0x802f644 <Address 0x802f644 out of bounds>, address =
134411844, chain = 0x802f644}, language_specific = {cplus_specific = {
        demangled_name = 0x0}}, language = language_auto, section = 20,
bfd_section = 0x109ea688}, info = 0x0, size = 20,
  filename = 0x10a09fe0 "rawmemchr.c", type = mst_bss, hash_next = 0x0,
demangled_hash_next = 0x0}

Now, i see the very same offset there, but now looks like it has been
shifted to a different address (ld's load address probably).

So, that's why i was imagining it wasn't really initialized yet.

Regards,
Luis