1172766 – ppc64: segv in libbfd

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1172766 - ppc64: segv in libbfd

Summary: ppc64: segv in libbfd

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	binutils
Sub Component:
Version:	7.1
Hardware:	ppc64
OS:	Linux
Priority:	medium
Severity:	medium
Target Milestone:	rc
Target Release:	---
Assignee:	Jeff Law
QA Contact:	Miloš Prchlík
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	1110700 1191021 1205796
TreeView+	depends on / blocked

Reported:	2014-12-10 17:13 UTC by Martin Cermak
Modified:	2015-11-19 03:34 UTC (History)
CC List:	5 users (show)
Fixed In Version:	binutils-2.23.52.0.1-41.el7
Doc Type:	Bug Fix
Doc Text:	Objdump on PowerPC no longer fails when accessing the symbol table Previously, objdump on 64-bit PowerPC incorrectly deallocated an important variable that held the symbol table for the binary being debugged, which caused a segmentation fault when objdump tried to access that symbol table. To solve this issue, this specific variable has been made persistent, and objdump can now access the needed information later during the debugging session, without reading an invalid memory region.
Clone Of:
Clones:	1190506 (view as bug list)
Environment:
Last Closed:	2015-11-19 03:34:58 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
Proposed patch. (8.64 KB, patch) 2015-02-08 17:05 UTC, Martin Sebor	no flags	Details \| Diff
View All

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:2079	0	normal	SHIPPED_LIVE	Moderate: binutils security, bug fix, and enhancement update	2015-11-19 07:41:11 UTC

Internal Links: 1183838

Description Martin Cermak 2014-12-10 17:13:09 UTC

I'm getting SEGV using binutils-2.23.52.0.1-26.el7.ppc64:


 7.1 S ppc64 # eu-unstrip /lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko /usr/lib/debug/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko.debug --output=/tmp/unstripped.ko
 7.1 S ppc64 # objdump -drS /tmp/unstripped.ko >/dev/null
Segmentation fault
 7.1 S ppc64 # 


 7.1 S ppc64 # rpm -q elfutils
elfutils-0.160-1.el7.ppc64
 7.1 S ppc64 # 


 7.1 S ppc64 # gdb -q --args objdump -drS /tmp/unstripped.ko
Reading symbols from /usr/bin/objdump...Reading symbols from /usr/bin/objdump...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Missing separate debuginfos, use: debuginfo-install binutils-2.23.52.0.1-26.el7.ppc64
(gdb) r


... stuff deleted ...


Program received signal SIGSEGV, Segmentation fault.
0x00003fffb7ddcf70 in .opd_entry_value () from /lib64/libbfd-2.23.52.0.1-26.el7.so
(gdb) bt
#0  0x00003fffb7ddcf70 in .opd_entry_value () from /lib64/libbfd-2.23.52.0.1-26.el7.so
#1  0x00003fffb7ddd5e8 in .ppc64_elf_maybe_function_sym () from /lib64/libbfd-2.23.52.0.1-26.el7.so
#2  0x00003fffb7df9358 in .elf_find_function () from /lib64/libbfd-2.23.52.0.1-26.el7.so
#3  0x00003fffb7e05d08 in ._bfd_elf_find_nearest_line_discriminator () from /lib64/libbfd-2.23.52.0.1-26.el7.so
#4  0x00000000100080f8 in .show_line ()
#5  0x000000001000bc70 in .disassemble_section ()
#6  0x00003fffb7dc1bbc in .bfd_map_over_sections () from /lib64/libbfd-2.23.52.0.1-26.el7.so
#7  0x000000001000729c in .disassemble_data ()
#8  0x000000001000a438 in .dump_bfd ()
#9  0x000000001000ab78 in .display_any_bfd ()
#10 0x0000000010005808 in .main ()
(gdb)

Comment 1 Martin Cermak 2014-12-10 17:19:11 UTC

Similarly using gdb:

 7.1 S ppc64 # rpm -q gdb
gdb-7.6.1-64.el7.ppc64
 7.1 S ppc64 # gdb -q /lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko
Reading symbols from /usr/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko...Reading symbols from /usr/lib/debug/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko.debug...Segmentation fault
 7.1 S ppc64 # 


 7.1 S ppc64 # gdb -q --args gdb -q /lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko
Reading symbols from /usr/bin/gdb...Reading symbols from /usr/lib/debug/usr/bin/gdb.debug...done.
done.
(gdb) r
Starting program: /usr/bin/gdb -q /lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/power8/libthread_db.so.1".
Detaching after fork from child process 40699.
Reading symbols from /usr/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko...Reading symbols from /usr/lib/debug/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko.debug...
Program received signal SIGSEGV, Segmentation fault.
0x0000000010393bf0 in ppc64_elf_get_synthetic_symtab (abfd=<optimized out>, static_count=<optimized out>, static_syms=<optimized out>, dyn_count=<optimized out>, dyn_syms=<optimized out>, ret=0x3fffffffdd40) at ../../bfd/elf64-ppc.c:3138
3138              if (!sym_exists_at (syms, opdsymend, symcount,
Missing separate debuginfos, use: debuginfo-install pcre-8.32-14.el7.ppc64
(gdb) 
(gdb) bt
#0  0x0000000010393bf0 in ppc64_elf_get_synthetic_symtab (abfd=<optimized out>, static_count=<optimized out>, static_syms=<optimized out>, dyn_count=<optimized out>, dyn_syms=<optimized out>, ret=0x3fffffffdd40) at ../../bfd/elf64-ppc.c:3138
#1  0x000000001014803c in elf_symfile_read (objfile=0x10999260, symfile_flags=<optimized out>) at ../../gdb/elfread.c:2369
#2  0x00000000101e3698 in read_symbols (objfile=<optimized out>, objfile@entry=0x10999260, add_flags=<optimized out>, add_flags@entry=6) at ../../gdb/symfile.c:827
#3  0x00000000101e2678 in syms_from_objfile_1 (objfile=objfile@entry=0x10999260, addrs=addrs@entry=0x10955ac0, offsets=offsets@entry=0x0, num_offsets=num_offsets@entry=0, add_flags=add_flags@entry=6) at ../../gdb/symfile.c:1027
#4  0x00000000101e2cac in syms_from_objfile (add_flags=6, num_offsets=0, offsets=0x0, addrs=0x10955ac0, objfile=0x10999260) at ../../gdb/symfile.c:1045
#5  symbol_file_add_with_addrs_or_offsets (abfd=abfd@entry=0x10938750, add_flags=<optimized out>, addrs=addrs@entry=0x10955ac0, flags=<optimized out>, parent=parent@entry=0x1093a800, num_offsets=0, offsets=0x0) at ../../gdb/symfile.c:1144
#6  0x00000000101e360c in symbol_file_add_separate (bfd=0x10938750, symfile_flags=<optimized out>, objfile=0x1093a800) at ../../gdb/symfile.c:1214
#7  0x00000000101482d0 in elf_symfile_read (objfile=0x1093a800, symfile_flags=<optimized out>) at ../../gdb/elfread.c:2490
#8  0x00000000101e3698 in read_symbols (objfile=<optimized out>, objfile@entry=0x1093a800, add_flags=<optimized out>, add_flags@entry=6) at ../../gdb/symfile.c:827
#9  0x00000000101e2678 in syms_from_objfile_1 (objfile=objfile@entry=0x1093a800, addrs=0x108a4740, addrs@entry=0x0, offsets=offsets@entry=0x0, num_offsets=num_offsets@entry=0, add_flags=add_flags@entry=6) at ../../gdb/symfile.c:1027
#10 0x00000000101e2cac in syms_from_objfile (add_flags=6, num_offsets=0, offsets=0x0, addrs=0x0, objfile=0x1093a800) at ../../gdb/symfile.c:1045
#11 symbol_file_add_with_addrs_or_offsets (abfd=abfd@entry=0x1089a9b0, add_flags=<optimized out>, addrs=0x0, flags=<optimized out>, parent=parent@entry=0x0, num_offsets=0, offsets=0x0) at ../../gdb/symfile.c:1144
#12 0x00000000101e2ebc in symbol_file_add_from_bfd (parent=0x0, flags=<optimized out>, addrs=<optimized out>, add_flags=<optimized out>, abfd=0x1089a9b0) at ../../gdb/symfile.c:1234
#13 symbol_file_add (name=name@entry=0x3ffffffff1d8 "/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko", add_flags=<optimized out>, addrs=addrs@entry=0x0, flags=flags@entry=0) at ../../gdb/symfile.c:1250
#14 0x00000000101e2f5c in symbol_file_add_main_1 (args=0x3ffffffff1d8 "/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko", from_tty=<optimized out>, flags=<optimized out>) at ../../gdb/symfile.c:1276
#15 0x00000000102127b4 in catch_command_errors (command=@0x10637480: 0x101e2fc0 <symbol_file_add_main>, arg=0x3ffffffff1d8 "/lib/modules/3.10.0-215.el7.ppc64/kernel/fs/nfsd/nfsd.ko", from_tty=<optimized out>, mask=<optimized out>) at ../../gdb/exceptions.c:573
#16 0x00000000102165a8 in captured_main (data=<optimized out>) at ../../gdb/main.c:1013
#17 0x0000000010212660 in catch_errors (func=@0x10639420: 0x102153a0 <captured_main>, func_args=0x3fffffffe978, errstring=0x10452028 "", mask=<optimized out>) at ../../gdb/exceptions.c:546
#18 0x0000000010216c84 in gdb_main (args=<optimized out>) at ../../gdb/main.c:1144
#19 0x0000000010056c64 in main (argc=<error reading variable: value has been optimized out>, argv=<optimized out>) at ../../gdb/gdb.c:34
(gdb)

Comment 5 Martin Sebor 2015-02-08 17:05:48 UTC

Created attachment 989450 [details]
Proposed patch.

The attached patch fixes the SIGSEGV in libbfd in RHEL 7.1 binutils by backporting upstream commit b53dfeb26: PowerPC64 ELFv1 function symbol definition vs LTO and discarded sections on top of the enabled ppc64le patches (bug #1183838) and also adjusting the changes made in that commit to avoid failures in the ifunc.exp test that it otherwise triggers. The patch is for binutils only (namely the private-rh1183838-rhel-7.1 branch) and doesn't contain a fix the GDB problem mentioned in the report.

Comment 12 Miloš Prchlík 2015-10-13 12:29:12 UTC

Verified for build binutils-2.23.52.0.1-54.el7.

Comment 14 errata-xmlrpc 2015-11-19 03:34:58 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2079.html

Note You need to log in before you can comment on or make changes to this bug.