Hello Ryutaroh Matsumoto, dear Maintainer,
I am not involved in packaging valgrind, just trying to
help with some random bug reports.
For this report #983377 I cannot follow, how #928224 is blocking it?

#928224 is about valgrind not running at all,
with "a function redirection ... cannot be set up" and exits.
This was not reproducible for me in 2019 inside a VM.




#983377 has "disInstr(thumb): unhandled instruction: 0xEC51 0x0F1E",
which seems to be tracked upstream in [1].
A valgrind package build with the patch [2] from this bug does
not show this "unhandled instruction" message anymore.
The instruction seems to be on purpose by openssl [3]
to detect certain cpu features.

[1] https://bugs.kde.org/show_bug.cgi?id=344802
[2] https://bugs.kde.org/attachment.cgi?id=113735
[3] https://sources.debian.org/src/openssl/1.1.1j-1/crypto/armcap.c/#L224

Program received signal SIGILL, Illegal instruction.
_armv7_tick () at crypto/armv4cpuid.S:136
136     crypto/armv4cpuid.S: Datei oder Verzeichnis nicht gefunden.
1: x/i $pc
=> 0x4b9f926 <_armv7_tick>:     mrrc    15, 1, r0, r1, cr14
(gdb) bt
#0  _armv7_tick () at crypto/armv4cpuid.S:136
#1  0x04b9a0fa in OPENSSL_cpuid_setup () at ../crypto/armcap.c:224
#2  0x0400bf40 in call_init (l=<optimized out>, argc=argc@entry=6, 
argv=argv@entry=0xbdf1c624, env=env@entry=0xbdf1c640) at dl-init.c:72
#3  0x0400bfe2 in call_init (env=<optimized out>, argv=<optimized out>, argc=<optimized 
out>, l=<optimized out>) at dl-init.c:30
#4  _dl_init (main_map=0x402a9b8, argc=6, argv=0xbdf1c624, env=0xbdf1c640) at 
dl-init.c:119
#5  0x04000ac4 in _dl_start_user () from /lib/ld-linux-armhf.so.3




#983377 shows also multiple "Invalid write ... below stack pointer".
Might this be kind of a stack protection?

There is an upstream bug describing something similar in Android
and there was a way to silence such access integrated:
    '--ignore-range-below-sp=1152-0'.

Maybe related, in [5] it looks like gcc was starting to emit
stack protection instructions in 2017.

[4] https://bugs.kde.org/show_bug.cgi?id=360571
[5] https://bugzilla.redhat.com/show_bug.cgi?id=1522678



Kind regards,
Bernhard



valgrind --vgdb=yes --vgdb-error=0 
/home/benutzer/autopkgtest.7hddQs/autopkgtest_tmp/mock-sshd --user=joe 
--password=foobar --port 1234 -v
gdb -q /home/benutzer/autopkgtest.7hddQs/autopkgtest_tmp/mock-sshd
target remote | vgdb

==30911== Invalid write of size 4
==30911==    at 0x4964BF6: libssh_constructor (init.c:111)
==30911==    by 0x400BF3F: call_init.part.0 (dl-init.c:72)
==30911==    by 0x400BFE1: call_init (dl-init.c:30)
==30911==    by 0x400BFE1: _dl_init (dl-init.c:119)
==30911==    by 0x4000AC3: ??? (in /usr/lib/arm-linux-gnueabihf/ld-2.31.so)
==30911==  Address 0xbda4d650 is on thread 1's stack
==30911==  8 bytes below stack pointer
==30911==
==30911== (action on error) vgdb me ...


Program received signal SIGTRAP, Trace/breakpoint trap.
0x04964bf6 in libssh_constructor () at ./src/init.c:111
111     {
1: x/i $pc
=> 0x4964bf6 <libssh_constructor+10>:   str.w   r0, [r12, #4088]        ; 0xff8
(gdb) disassemble libssh_constructor,libssh_constructor+40
Dump of assembler code from 0x4964bec to 0x4964c14:
   0x04964bec <libssh_constructor+0>:   push    {r4, lr}
   0x04964bee <libssh_constructor+2>:   mov.w   r12, #4096      ; 0x1000
   0x04964bf2 <libssh_constructor+6>:   sub.w   r12, sp, r12
=> 0x04964bf6 <libssh_constructor+10>:  str.w   r0, [r12, #4088]        ; 0xff8
   0x04964bfa <libssh_constructor+14>:  ldr     r2, [pc, #84]   ; (0x4964c50 
<libssh_constructor+100>)
   0x04964bfc <libssh_constructor+16>:  ldr     r4, [pc, #84]   ; (0x4964c54 
<libssh_constructor+104>)
   0x04964bfe <libssh_constructor+18>:  add     r2, pc
End of assembler dump.
(gdb) print/x $r0
$1 = 0x6
(gdb) print/x $r12
$2 = 0xbda4c658
(gdb) print/x $sp
$3 = 0xbda4d658
(gdb) print/x $pc
$4 = 0x4964bf7
(gdb) bt
#0  0x04964bf6 in libssh_constructor () at ./src/init.c:111
#1  0x0400bf40 in call_init (l=<optimized out>, argc=argc@entry=6, 
argv=argv@entry=0xbda4d6a4, env=env@entry=0xbda4d6c0) at dl-init.c:72
#2  0x0400bfe2 in call_init (env=<optimized out>, argv=<optimized out>, argc=<optimized 
out>, l=<optimized out>) at dl-init.c:30
#3  _dl_init (main_map=0x402a9b8, argc=6, argv=0xbda4d6a4, env=0xbda4d6c0) at 
dl-init.c:119
#4  0x04000ac4 in _dl_start_user () from /lib/ld-linux-armhf.so.3
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Reply via email to