Description of problem: With some compiled programs I have been able to crash the linux loader. This seems to be x86_64 specific. Version-Release number of selected component (if applicable): glibc-2.10.90-14.x86_64 How reproducible: Quite often more then 80% Steps to Reproduce: 1. Certain programs compiled will crash I cannot say what but two of them I have been able to crash loader. Results from debug: (gdb) run --check --cache /root/kdebase-dev/runtime/doc/kcontrol/passwords/index.cache.bz2 /root/kdebase/runtime/doc/kcontrol/passwords/index.docbook Starting program: /usr/local/kde4/bin/meinproc4 --check --cache /root/kdebase-dev/runtime/doc/kcontrol/passwords/index.cache.bz2 /root/kdebase/runtime/doc/kcontrol/passwords/index.docbook [Thread debugging using libthread_db enabled] Detaching after fork from child process 15646. Program received signal SIGILL, Illegal instruction. _dl_x86_64_restore_sse () at ../sysdeps/x86_64/dl-trampoline.S:223 223 vmovdqa %fs:RTLD_SAVESPACE_SSE+0*YMM_SIZE, %ymm0 (gdb) bt full #0 _dl_x86_64_restore_sse () at ../sysdeps/x86_64/dl-trampoline.S:223 No locals. #1 0x00007ffff7deb6e5 in _dl_fixup (l=<value optimized out>, reloc_arg=<value optimized out>) at ../elf/dl-runtime.c:126 version = <value optimized out> flags = <value optimized out> reloc = <value optimized out> sym = 0x7ffff403d5b0 result = 0x7ffff7fdd990 value = <value optimized out> __PRETTY_FUNCTION__ = "_dl_fixup" #2 0x00007ffff7df1bb5 in _dl_runtime_resolve () at ../sysdeps/x86_64/dl-trampoline.S:41 No locals. #3 0x0000000000405520 in main (argc=5, argv=0x7fffffffe4c8) at /root/kdelibs/kdoctools/meinproc.cpp:179 buf = "\001\000\000\000\377\177\000\000\230i\375\367\377\177\000\000`\326\377\377\377\177\000\000\000\000\000\000\000\000\000\000h\353\213\367\377\177\000\000\364\237\336\367\377\177\000\000\001\000\000\000\256-\356\325\310d\375\367\377\177\000\000\240\327\377\377\377\177\000\000\000\000\000\000\000\000\000\000H\353\213\367\377\177\000\000\364\237\336\367\377\177\000\000\001\000\000\000\377\177\000\000\000`\375\367\377\177\000\000\320\327\377\377\377\177\000\000\000\000\000\000\000\000\000\000\070\353\213\367\377\177\000\000\364\237\336\367\377\177\000\000\001\000\000\000\000\000\000\000\300v\375\367\377\177\000\000\000\330\377\377\377\177\000\000\000\000\000\000\000\000\000\000(\353\213\367\377\177\000\000\364\237\336\367\377\177\000\000\000\300\375\367\377\177\000\000\300v\375\367\377\177\000\000\000`\375\367\377\177\000\000\310d\375\367\377\177\000\000\320\024\376\367\377\177\000\000\230i\375\367\377\177\000\000\260\351\375\367\377\177\000\000\000\320\375\367\377\177\000\000\310\324\375\367\377\177\000\000\220\331\375\367\377\177\000\000\000\000\000\000\000\000\000\000\205B\222\367\377\177\000\000\200\334\377\377\377\177\000\000\000\000\240\260\377\377\377\377\000\000vp\275\357\377\377\340\246\377\367\377\177\000\000\025\000\000\000\000\000\000\000\fB\222\367\377\177\000\000\200\334\377\377\377\177\000\000\000\000\000\261\377\377\377\377\000\000vp\275"... noout = true cmd = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 47}, alloc = 0, size = 0, data = 0x60c7fa, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 57}, alloc = 0, size = 0, data = 0x7ffff78bfa3a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x63ba00, static codecForCStrings = 0x0} xmllint = 0x63d3a0 n = 0 pwd_buffer = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 47}, alloc = 0, size = 0, data = 0x60c7fa, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 57}, alloc = 0, size = 0, data = 0x7ffff78bfa3a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x63b750, static codecForCStrings = 0x0} file = {d_ptr = 0x63c180} catalogs = {static shared_null = {ref = {_q_value = 182}, alloc = 0, size = 0, data = 0x60c818 "", array = ""}, static shared_empty = {ref = {_q_value = 2}, alloc = 0, size = 0, data = 0x7ffff78bf8f8 "", array = ""}, d = 0x63d1c0} exe = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 47}, alloc = 0, size = 0, data = 0x60c7fa, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 57}, alloc = 0, size = 0, data = 0x7ffff78bfa3a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x63c8f0, static codecForCStrings = 0x0} aboutData = {d = 0x614860} params = {{p = 0x7fffffffdaa0, d = 0x7fffffffdaa0}} app = <incomplete type> ins = {_vptr.KComponentData = 0x7ffff7259470, d = 0x62d1f0} checkFile = {d_ptr = 0x63b100} __PRETTY_FUNCTION__ = "int main(int, char**)" tss = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 47}, alloc = 0, size = 0, data = 0x60c7fa, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 57}, alloc = 0, size = 0, data = 0x7ffff78bfa3a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x7fff00000001, static codecForCStrings = 0x0} options = {d = 0x613a90} args = 0x628ba0 srcdir = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 47}, alloc = 0, size = 0, data = 0x60c7fa, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 57}, alloc = 0, size = 0, data = 0x7ffff78bfa3a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x60c7e0, static codecForCStrings = 0x0} checkFilename = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 47}, alloc = 0, size = 0, data = 0x60c7fa, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 57}, alloc = 0, size = 0, data = 0x7ffff78bfa3a, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0x63af10, static codecForCStrings = 0x0} index = false Additional info: I also am able to crash loader when using LD_BIND_NOW=true LD_BIND_NOW=true /usr/local/kde4/lib64/kde4/libexec/start_kdeinit_wrapper +kcminit_startup ^^ but it seems to only crash when used in the bash shell script 'startkde'. Removing LD_BIND_NOW does cause an illegal instruction either. I don't know if the two are related (they may).
Removing LD_BIND_NOW does NOT cause an illegal instruction either. I don't know if the two are related (they may).
What is the contents of have_avx at this point?
how to get this? gdb says that symbol is not in current context.
model name : Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz flags : fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx lm constant_tsc arch_perfmon pebs bts rep_good pni dtes64 monitor ds_cpl vmx est tm2 ssse3 cx16 xtpr pdcm lahf_lm tpr_shadow vnmi flexpriority
This CPU could not have AVX extensions, no CPUS sold have it yet
I have a patch upstream which probably fixes this. This doesn't have to do with processor versions etc. Andreas will build a new glibc RPM hopefully soon.
Should be fixed in 2.10.90-16.
I have been fighting this problem for a little while now, and I can answer Andreas's question in c#2: have_avx is zero: Program terminated with signal 4, Illegal instruction. #0 0x00002b6737c2c229 in _dl_x86_64_restore_sse () from /lib64/ld-linux-x86-64.so.2 (gdb) x/i $pc 0x2b6737c2c229 <_dl_x86_64_restore_sse+9>: vmovdqa %fs:0x80,%ymm0 (gdb) x/12i _dl_x86_64_restore_sse 0x2b6737c2c220 <_dl_x86_64_restore_sse>: cmpl $0x0,0x20bd29(%rip) # 0x2b6737e37f50 0x2b6737c2c227 <_dl_x86_64_restore_sse+7>: js 0x2b6737c2c27a <_dl_x86_64_restore_sse+90> 0x2b6737c2c229 <_dl_x86_64_restore_sse+9>: vmovdqa %fs:0x80,%ymm0 0x2b6737c2c233 <_dl_x86_64_restore_sse+19>: vmovdqa %fs:0x90,%ymm1 ... (gdb) x/w 0x2b6737e37f50 0x2b6737e37f50: 0x00000000 (gdb) bt #0 0x00002b6737c2c229 in _dl_x86_64_restore_sse () from /lib64/ld-linux-x86-64.so.2 #1 0x00002b6737c256e5 in _dl_fixup () from /lib64/ld-linux-x86-64.so.2 #2 0x00002b6737c2bbb5 in _dl_runtime_resolve () from /lib64/ld-linux-x86-64.so.2 I am not sure how it is that control might reach _dl_x86_64_restore_sse without having previously passed through _dl_x86_64_save_sse, as the assembly coding clearly expects must always be the case. However, I have more than enough evidence now to say that it sometimes *does* do that, especially in multithreaded programs. I would suggest that the quickest and most reliable fix is to duplicate the have_avx initialization logic into _dl_x86_64_restore_sse too. Dunno if that's what the upstream patch does.
Re-opening, since no glibc builds > 15 are available yet (koji builds have failed).
It's blocked by nss.
Fixed.
glibc-2.10.90-17 seems broken, every application starts with LD_BIND_NOW=true crahes, for examle: LD_BIND_NOW=true gdb
Don't hijack bugs with completely unrelated reports. Open a new bug, if necessary.
In fairness, it was mentioned here in comment #1 too, "I also am able to crash loader when using LD_BIND_NOW=true", but tracking 1 bug per report is preferable for everyone.