Red Hat Bugzilla – Bug 145193
ia32 gdb blows up the kernel
Last modified: 2015-01-04 17:15:38 EST
Description of problem:
Version-Release number of selected component (if applicable):
Dunno. I can try again.
Steps to Reproduce:
1. Install 32-bit chroot.
3. Attempt to install a kernel rpm
4. Watch rpm segfault
# rpm -i kernel-2.6.10-1.737_FC3.i686.rpm --force
5. Attempt to debug rpm
# gdb /usr/lib/rpm/rpmi
<gdb> set args -i kernel-2.6.10-1.737_FC3.i686.rpm --force
Created attachment 109807 [details]
a) I was root
b) strace doesn't oops
It's reproducible with any 32-bit process, it appears.
Please supply a trivial recipe for "reproduce with any 32-bit process".
I didn't have any luck making it crash. (I'm testing the 1.741_FC3.x86_64
kernel, but on otherwise RHEL4 userland since that's the install I have handy.
Also, this is EM64T rather than AMD64.)
Ok, I think I have a clue. It's not any 32-bit process, but any 32-bit process
that hasn't previously used the vsyscall page (e.g. by making a syscall).
So probably you can only see it on a statically linked app, since those don't
use the vsyscall mechanism for syscalls. The lazy mapping done in get_gate_vma
(__map_syscall32) seems like it should make the pte happy, but it appears not to.
However, the normal fault path (i.e. the process itself doing a normal read from
0xffffe000) does make it happy so that access_process_vm works thereafter.
Vanilla 2.6.10 on x86-64 does have the same bug.
Created attachment 109836 [details]
What a maroon.
Has this been committed to the kernel?
An update has been released for Fedora Core 3 (kernel-2.6.12-1.1372_FC3) which
may contain a fix for your problem. Please update to this new kernel, and
report whether or not it fixes your problem.
If you have updated to Fedora Core 4 since this bug was opened, and the problem
still occurs with the latest updates for that release, please change the version
field of this bug to 'fc4'.
This bug has been automatically closed as part of a mass update.
It had been in NEEDINFO state since July 2005.
If this bug still exists in current errata kernels, please reopen this bug.
There are a large number of inactive bugs in the database, and this is the only
way to purge them.