If there is no e_phoff e_phnum cannot be trusted. Extended phnum can only
be gotten if we have an actual section table and a shdr for section zero,
Extended phnum can be too large to fit in the file (or a size_t).
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Since ELF notes need to be properly aligned they can include padding.
Make sure the padding itself and the padding calculation doesn't overflow.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
On 32bit arches size_t is too small to do size and overflow checks
of 64bit ELF files. Use the actual Elf64 types to make sure checks
on 64bit ELF files are done correctly on 32bit arches.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
commit 037505 "Fix resolving ELF symbols for live PIDs with deleted files"
changed find_dynsym to assume the PT_DYNAMIC entries had been adjusted by
the dynamic linker. That is often a correct assumption when the ELF image
comes from remote memory. But we cannot rely on that. In the case of the
vdso image the DYNAMIC segment has not been adjusted for example.
There is no good way to determine whether the DYNAMIC segment has or
hasn't been adjusted already to the load address by the dynamic linker.
So we just try twice. Once without and if the fails again with assuming
adjustments being applied.
Includes a new vdsosyms testcase that fails on i686 before and succeeds
after the fix.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
__libdw_getsrclines should have been marked as internal_function in
both libdwP.h and dwarf_getsrclines.c. Do address_size comparison as
uint8_t to avoid signedness warning.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
- This code is based on the following proposal:
http://www.dwarfstd.org/ShowIssue.php?issue=110722.1
- dwarf_getmacros serves either of .debug_macinfo or .debug_macro
transparently, but if the latter uses opcode 0xff, it bails out with
an error. The reason is that in .debug_macro, 0xff is a custom code
that can mean anything, while in .debug_macinfo there's fixed
semantics associated with 0xff.
- dwarf_getmacros_off is a new interface used for requesting iteration
through transparently included units.
- dwarf_macro_getparamcnt and dwarf_macro_param are new interfaces
used for requesting number of parameters of an opcode and individual
parameters. dwarf_macro_getsrcfiles is a new interface used for
requesting a file part of .debug_line unit associated with macro
unit that the opcode comes from.
- The existing interfaces dwarf_macro_opcode, dwarf_macro_param1 and
dwarf_macro_param2 remain operational for old- as well as new-style
Dwarf macro sections, if applicable.
- dwarf_getsrclines was made into a light wrapper around a worker
function that loads line unit given its offset. The worker also
caches loaded units in an offset-keyed search tree, so that we don't
end up re-reading units even though they were read in a different
domain (e.g. a macro unit request can prime cache for later CU
lookup). dwarf_macro_getsrcfiles calls the worker function under
covers.
Signed-off-by: Petr Machata <pmachata@redhat.com>
We check whether the elements are set before printing their contents,
but didn't make sure they were initialized.
Reported-by: Hanno Böck <hanno@hboeck.de>
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Add new function dwarf_peel_type. Some type annotations in DWARF are
specified by modifier tag type wrappers instead of attributes.
For type aliases (typedef) and qualifiers (const, volatile, restrict)
tags dwarf_peel_type follows the DW_AT_type attributes till it finds
a base, user-defined, reference or pointer type DIE.
Use this new function in the backends for return type DIEs (replacing
the existing dwarf_peel_type there) and in dwarf_aggregate_size so
it can provide the sizes for qualified types too. Add a new version
and testcase for the new dwarf_aggregate_size functionality.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
DW_AT_GNU_deleted is added by G++ for C++11 deleted special member
functions (= delete;). This is a constant only addition to dwarf.h.
No other part of elfutils currently depends on this attribute.
Also added to https://fedorahosted.org/elfutils/wiki/DwarfExtensions
Signed-off-by: Mark Wielaard <mjw@redhat.com>
We don't want to run the deleted test process under valgrind then
eu-stack will see the valgrind process backtrace.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Martin Milata:
------------------------------------------------------------------------------
RFE: dwfl_core_file_report: use NT_FILE core note if the link_map chain is broken
https://bugzilla.redhat.com/show_bug.cgi?id=1129777
The dwfl_core_file_report function follows dynamic linker's link_map chain in
order to determine the shared libraries used by the executable. As this data
structure is located in writable memory it can be overwritten by garbage, which
is sometimes the case.
https://github.com/abrt/satyr/issues/127#issuecomment-46957546
Since version 3.7 (commit 2aa362c49), Linux kernel adds NT_FILE note to core
files which contains the files mapped by the process, including shared
libraries.
------------------------------------------------------------------------------
dwfl_core_file_report now tries to fall back on NT_FILE if the link_map chain
is broken.
elfutils would already find the appropriate binary file from
/usr/lib/debug/.build-id/ symbolic links. But those symbolic links do not have
to be present on the system while NT_FILE still points to the correct binaries.
Filenames from the note NT_FILE are used only if link_map filenames failed to
locate matching binaries.
tests/test-core.core.bz2 had to have its NT_FILE disabled as run-unstrip-n.sh
otherwise FAILs:
FAIL: 0x7f67f2aaf000+0x202000 - . - /home/jkratoch/redhat/elfutils-libregr/test-core-lib.so
PASS: 0x7f67f2aaf000+0x202000 - . - test-core-lib.so
As test-core-lib.so is found in link_map but it is not present on the disk
elfutils now chooses the more reliable filename from NT_FILE (although that
filename is also not found on the disk). Updating the expected text would be
also sufficient.
libdwfl/
2014-09-26 Jan Kratochvil <jan.kratochvil@redhat.com>
Support NT_FILE for locating files.
* core-file.c (dwfl_core_file_report): New variables note_file and
note_file_size, set them and pass them to dwfl_segment_report_module.
* dwfl_segment_report_module.c: Include common.h and fcntl.h.
(buf_has_data, buf_read_ulong, handle_file_note): New functions.
(invalid_elf): New function from code of dwfl_segment_report_module.
(dwfl_segment_report_module): Add parameters note_file and
note_file_size. New variables elf and fd, clean them up in finish.
Move some code to invalid_elf. Call handle_file_note, if it found
a name verify the file by invalid_elf. Protect elf and fd against
cleanup by finish if we found the file for new Dwfl_Module.
* libdwflP.h (dwfl_segment_report_module): Add parameters note_file and
note_file_size.
tests/
2014-09-26 Jan Kratochvil <jan.kratochvil@redhat.com>
Support NT_FILE for locating files.
* Makefile.am (TESTS): Add run-linkmap-cut.sh.
(EXTRA_DIST): Add run-linkmap-cut.sh, linkmap-cut-lib.so.bz2,
linkmap-cut.bz2 and linkmap-cut.core.bz2 .
* linkmap-cut-lib.so.bz2: New file.
* linkmap-cut.bz2: New file.
* linkmap-cut.core.bz2: New file.
* run-linkmap-cut.sh: New file.
* run-unstrip-n.sh: Update its expected output.
Signed-off-by: Jan Kratochvil <jan.kratochvil@redhat.com>
To make it easier to see that the code is using the correct fields of
the ehdr e32/e64 union extract ei_class, ei_data and e_type early and
use them directly.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
- Testing shdr makes no sense, that pointer was dereferenced several
times throughout the section. destshdr on the other hand is not
tested at all.
Signed-off-by: Petr Machata <pmachata@redhat.com>
Next patch will find module names from NT_FILE note so that main executable
will no longer necessarily have the name "[exe]" or "[pie]".
-e|--executable still should be able to override such module.
libdwfl/
2014-09-18 Jan Kratochvil <jan.kratochvil@redhat.com>
* dwfl_build_id_find_elf.c (dwfl_build_id_find_elf): Use IS_EXECUTABLE.
* dwfl_segment_report_module.c (dwfl_segment_report_module): Set
IS_EXECUTABLE.
* libdwflP.h (struct Dwfl_Module): New field is_executable.
Signed-off-by: Jan Kratochvil <jan.kratochvil@redhat.com>
- The behavior of this function has been changed to read only
address-sized quantities, i.e. the size of 2 is no longer allowed.
(Size of 1 never was.) The two outstanding uses, both in readelf.c,
which actually do use this call to read address-sized units, were
updated, rejecting fields that indicate weird address sizes.
- The three related calls, read_sbyte_unaligned_inc,
read_ubyte_unaligned and read_sbyte_unaligned were dropped. There
are currently no uses for these calls.
Signed-off-by: Petr Machata <pmachata@redhat.com>
- The problem this is trying to solve can be seen for example thus:
$ eu-readelf -a /
eu-readelf: failed reading '/': (null)
With the fix we see a proper error number and get a reasonable error
message:
$ eu-readelf -a /
eu-readelf: failed reading '/': invalid file descriptor
Signed-off-by: Petr Machata <pmachata@redhat.com>
For deleted shared library files the offsets to the symbol table were
calculated wrongly from the phdrs because the main_bias wasn't taken into
account.
Formerly shared libraries did not get resolved properly:
#2 0x00007fc4d86c56d6
#3 0x0000000000400938 main
Fixed elfutils produce:
#2 0x00007f61094876d6 libfunc
#3 0x0000000000400938 main
Signed-off-by: Jan Kratochvil <jan.kratochvil@redhat.com>
The Makefile rule for make-debug-archive has a sed expression to replace
@AR@ will the installed name, but this was itself getting replaced when
the Makefile was configured, for a pattern like "s,ar,/path/prefix-,g".
Havoc ensued in the resulting make-debug-archive.
The fix matches it using a regex bracket expression, "[@]AR[@]", so sed
will still match it, but it's immune to configure's replacement.
Signed-off-by: Josh Stone <jistone@redhat.com>
Given a Dwarf_Die or Dwarf_Attribute it is often convenient to get at the
CU DIE and the CU header information. There is dwarf_diecu but that doesn't
provide all information from the header and it doesn't work for attributes.
Add a new dwarf_cu_die function that provides all information given a
Dwarf_CU, which both Dwarf_Die and Dwarf_Attribute reference.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
In both systemtap and libabigail there is a need to get the actual Dwarf
underlying an Dwarf_Die or Dwarf_Attribute. Following a DIE reference
might end up in an alternate Dwarf since the addition of DWZ multifile
forms. Both Dwarf_Die and Dwarf_Attribute already contain a Dwarf_CU
handle. Add a function dwarf_cu_getdwarf to retrieve the underlying
Dwarf using the Dwarf_CU.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
glibc now supplies these (compatible) structs instead of including the
kernel's <asm/ptrace.h> header, so let's use them. Annoyingly this will
cause new elfutils to FTBFS on old glibc, and vice versa. So include a
new configure check for the new struct names and use the old ones if
they are not avilable.
Signed-off-by: Kyle McMartin <kyle@redhat.com>
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The big endian vs little endian changes are already handled by detecting
the EI_DATA data encoding. And the function descriptors are already not
used when we see there is no .opd section. This change adds new checks
for st_other bits, new relocations and recognizes DT_PPC64_OPT.
Signed-off-by: Menanteau Guy <menantea@linux.vnet.ibm.com>
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The DW_TAG_mutable_type was only mentioned in an early draft of DWARFv3.
But was removed because there are no C++ mutable qualified types. It was
replaced by a new attribute DW_AT_mutable on DW_TAG_member DIEs. The new
attribute is available in dwarf.h.
http://dwarfstd.org/ShowIssue.php?issue=050223.1
DW_TAG_mutable_type was only used internally in some backends (which
just ignored it anyway). dwarves did use it to turn it into a string
value, libabigail used it and ignored it (patches to remove sent).
GCC, GDB and binutils don't use nor define it.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The ARM EABI says that the zero bit of function symbol st_value indicates
whether the symbol points to a THUMB or ARM function. Also the return
value address in an unwind will contain the same extra bit to indicate
whether to return to a regular ARM or THUMB function. Add a new ebl
function to mask off such bits and turn a function value into a function
address so that we get the actual value that a function symbol or return
address points to. It isn't easily possible to reuse the existing
ebl_resolve_sym_value for this purpose, so we end up with another hook
that can be used from dwfl_module_getsym, handle_cfi and elflint.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
On some architectures (Debian armhl) system calls go through
__libc_do_syscall instead of __kernel_vsyscall. Accept either of
these symbol names for the first backtrace frame.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
The special arm check in check_unsupported should only trigger for native
tests, otherwise on arm various backtrace tests would be skipped that
should work just fine.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
Mark Wielaard