Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 4 Jul 2015 00:11:11 +0300
From:      Konstantin Belousov <kostikbel@gmail.com>
To:        Andre Meiser <ortadur@web.de>
Cc:        freebsd-stable@freebsd.org
Subject:   Re: Many core dumps in pthread_getspecific.
Message-ID:  <20150703211111.GZ2080@kib.kiev.ua>
In-Reply-To: <trinity-9d219acd-7aa9-4574-a9ad-458b52374069-1435936910016@3capp-webde-bs27>
References:  <trinity-d3a62468-a8fd-44c3-ab9c-8b177ca8a366-1433331244003@3capp-webde-bs60> <20150603145838.GX2499@kib.kiev.ua> <trinity-15fcacbd-871c-4ea8-9257-5d11e7862ec0-1434103396559@3capp-webde-bs41> <20150614190504.GT2080@kib.kiev.ua> <trinity-e44527ae-e511-4ff3-bcdf-ee8426fc8a94-1434438565708@3capp-webde-bs53> <20150616073637.GO2080@kib.kiev.ua> <trinity-9d219acd-7aa9-4574-a9ad-458b52374069-1435936910016@3capp-webde-bs27>

next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Jul 03, 2015 at 05:21:50PM +0200, Andre Meiser wrote:
> Hi,
> 
> back again. Sorry, I accidently deleted the core file and I'd to wait two weeks until vim crashed again. Xorg didn't crashed so far with the debug libs.
> 
> On Tue, Jun 16, 2015 at 09:36 +0200, Konstantin Belousov wrote:
> > Ok, so the vim fault is reproducable, I suppose ?
> 
> No, I tried, but no chance to do it on purpose. But so far it always happens while resizing the xterm.
> 
> Now the entire info you asked for (out of the new core file):
> 
> 
> % readelf -d vim | grep NEEDED
>  0x0000000000000001 (NEEDED)             Shared library: [libm.so.5]
>  0x0000000000000001 (NEEDED)             Shared library: [libncurses.so.8]
>  0x0000000000000001 (NEEDED)             Shared library: [libintl.so.8]
>  0x0000000000000001 (NEEDED)             Shared library: [libpython2.7.so.1]
>  0x0000000000000001 (NEEDED)             Shared library: [libthr.so.3]
>  0x0000000000000001 (NEEDED)             Shared library: [libc.so.7]
> 
> (gdb) bt
> #0  0x000000080149e6a2 in check_deferred_signal (curthread=0x802406400) at /usr/src/lib/libthr/thread/thr_sig.c:331
> #1  0x000000080149e5ed in _thr_ast (curthread=0x802406400) at /usr/src/lib/libthr/thread/thr_sig.c:264
> #2  0x00000008014a33c7 in _thr_rtld_lock_release (lock=<value optimized out>) at /usr/src/lib/libthr/thread/thr_rtld.c:162
> #3  0x000000080083d94d in _r_debug_postinit () from /libexec/ld-elf.so.1
> #4  0x000000080083b15d in .text () from /libexec/ld-elf.so.1
> #5  0x00000000004e4163 in preserve_exit ()
> #6  0x000000000051f118 in mch_libcall ()
> #7  0x000000080149f47a in handle_signal (actp=<value optimized out>, sig=<value optimized out>, info=<value optimized out>, ucp=<value optimized out>) at /usr/src/lib/libthr/thread/thr_sig.c:240
> #8  0x000000080149f062 in thr_sighandler (sig=<value optimized out>, info=<value optimized out>, _ucp=<value optimized out>) at /usr/src/lib/libthr/thread/thr_sig.c:183
> #9  <signal handler called>
> #10 0x000000080149e6a2 in check_deferred_signal (curthread=0x802406400) at /usr/src/lib/libthr/thread/thr_sig.c:331
> #11 0x000000080149e5ed in _thr_ast (curthread=0x802406400) at /usr/src/lib/libthr/thread/thr_sig.c:264
> #12 0x00000008014a33c7 in _thr_rtld_lock_release (lock=<value optimized out>) at /usr/src/lib/libthr/thread/thr_rtld.c:162
> #13 0x000000080083d94d in _r_debug_postinit () from /libexec/ld-elf.so.1
> #14 0x000000080083b15d in .text () from /libexec/ld-elf.so.1
> #15 0x000000080149f4e2 in handle_signal (actp=<value optimized out>, sig=<value optimized out>, info=<value optimized out>, ucp=<value optimized out>) at /usr/src/lib/libthr/thread/thr_sig.c:256
> #16 0x000000080149f062 in thr_sighandler (sig=<value optimized out>, info=<value optimized out>, _ucp=<value optimized out>) at /usr/src/lib/libthr/thread/thr_sig.c:183
> #17 <signal handler called>
> #18 select () at select.S:3
> #19 0x000000080149cb32 in __select (numfds=1, readfds=0x7fffffffdfb0, writefds=0x0, exceptfds=0x7fffffffdf30, timeout=0x7fffffffe038) at /usr/src/lib/libthr/thread/thr_syscalls.c:561
> #20 0x000000000051ac4b in mch_write ()
> #21 0x000000000051ae0f in mch_inchar ()
> #22 0x00000000005b8647 in ui_inchar ()
> #23 0x00000000004aeb8a in inchar ()
> #24 0x00000000004b1ffb in vgetc ()
> #25 0x00000000004b0efa in vgetc ()
> #26 0x00000000004b27b9 in safe_vgetc ()
> #27 0x00000000004f59ef in normal_cmd ()
> #28 0x00000000005dfec7 in main_loop ()
> #29 0x00000000005df538 in main ()
> 
> 
> (gdb) info locals
> act = {__sigaction_u = {__sa_handler = 0, __sa_sigaction = 0}, sa_flags = 37875000, sa_mask = {__bits = {8, 4239276, 0, 0}}}
> info = {si_signo = 0, si_errno = 0, si_code = 37875000, si_pid = 8, si_uid = 37874640, si_status = 8, si_addr = 0x700000008, si_value = {sival_int = 37875104, sival_ptr = 0x80241eda0, sigval_int = 37875104, sigval_ptr = 0x80241eda0}, _reason = {_fault = {_trapno = 141}, 
>     _timer = {_timerid = 141, _overrun = 0}, _mesgq = {_mqd = 141}, _poll = {_band = 141}, __spare__ = {__spare1__ = 141, __spare2__ = {0, 0, 8744960, 8, 37874976, 8, 8641467}}}}
> 
> 
> (gdb) info registers
> rax            0xf0b470 15774832
> rbx            0x802406400      34397512704
> rcx            0x1      1
> rdx            0x80085b800      34368501760
> rsi            0x80241ed38      34397613368
> rdi            0x8015137d0      34381838288
> rbp            0x80241ecd0      0x80241ecd0
> rsp            0x8015137d0      0x8015137d0
> r8             0x800856600      34368480768
> r9             0x8080808080808080       -9187201950435737472
> r10            0x41b778 4306808
> r11            0x5262   21090
> r12            0x1      1
> r13            0x839888 8624264
> r14            0x8015137d0      34381838288
> r15            0x2      2
> rip            0x80149e6a2      0x80149e6a2 <check_deferred_signal+82>
> eflags         0x10202  66050
> cs             0x43     67
> ss             0x3b     59
> ds             0x0      0
> es             0x0      0
> fs             0x0      0
> gs             0x0      0
> 
> 
> (gdb) disassemble
> Dump of assembler code for function check_deferred_signal:
> 0x000000080149e650 <check_deferred_signal+0>:   push   %rbp
> 0x000000080149e651 <check_deferred_signal+1>:   mov    %rsp,%rbp
> 0x000000080149e654 <check_deferred_signal+4>:   push   %r15
> 0x000000080149e656 <check_deferred_signal+6>:   push   %r14
> 0x000000080149e658 <check_deferred_signal+8>:   push   %rbx
> 0x000000080149e659 <check_deferred_signal+9>:   sub    $0x78,%rsp
> 0x000000080149e65d <check_deferred_signal+13>:  mov    %rdi,%rbx
> 0x000000080149e660 <check_deferred_signal+16>:  cmpl   $0x0,0x100(%rbx)
> 0x000000080149e667 <check_deferred_signal+23>:  je     0x80149e672 <check_deferred_signal+34>
> 0x000000080149e669 <check_deferred_signal+25>:  cmpl   $0x0,0x180(%rbx)
> 0x000000080149e670 <check_deferred_signal+32>:  je     0x80149e67d <check_deferred_signal+45>
> 0x000000080149e672 <check_deferred_signal+34>:  lea    -0x18(%rbp),%rsp
> 0x000000080149e676 <check_deferred_signal+38>:  pop    %rbx
> 0x000000080149e677 <check_deferred_signal+39>:  pop    %r14
> 0x000000080149e679 <check_deferred_signal+41>:  pop    %r15
> 0x000000080149e67b <check_deferred_signal+43>:  pop    %rbp
> 0x000000080149e67c <check_deferred_signal+44>:  retq   
> 0x000000080149e67d <check_deferred_signal+45>:  movl   $0x1,0x180(%rbx)
> 0x000000080149e687 <check_deferred_signal+55>:  callq  0x801498e44 <__getcontextx_size@plt>
> 0x000000080149e68c <check_deferred_signal+60>:  cltq   
> 0x000000080149e68e <check_deferred_signal+62>:  mov    %rsp,%r14
> 0x000000080149e691 <check_deferred_signal+65>:  add    $0xf,%rax
> 0x000000080149e695 <check_deferred_signal+69>:  and    $0xfffffffffffffff0,%rax
> 0x000000080149e699 <check_deferred_signal+73>:  sub    %rax,%r14
> 0x000000080149e69c <check_deferred_signal+76>:  mov    %r14,%rsp
> 0x000000080149e69f <check_deferred_signal+79>:  mov    %r14,%rdi
> 0x000000080149e6a2 <check_deferred_signal+82>:  callq  0x801499214 <getcontext@plt>
> 0x000000080149e6a7 <check_deferred_signal+87>:  cmpl   $0x0,0x100(%rbx)
> 0x000000080149e6ae <check_deferred_signal+94>:  je     0x80149e73b <check_deferred_signal+235>
> 0x000000080149e6b4 <check_deferred_signal+100>: lea    0x100(%rbx),%r15
> 0x000000080149e6bb <check_deferred_signal+107>: mov    %r14,%rdi
> 0x000000080149e6be <check_deferred_signal+110>: callq  0x801499064 <__fillcontextx2@plt>
> 0x000000080149e6c3 <check_deferred_signal+115>: movups 0x160(%rbx),%xmm0
> 0x000000080149e6ca <check_deferred_signal+122>: movups 0x170(%rbx),%xmm1
> 0x000000080149e6d1 <check_deferred_signal+129>: movaps %xmm1,-0x30(%rbp)
> 0x000000080149e6d5 <check_deferred_signal+133>: movaps %xmm0,-0x40(%rbp)
> 0x000000080149e6d9 <check_deferred_signal+137>: movups 0x150(%rbx),%xmm0
> 0x000000080149e6e0 <check_deferred_signal+144>: movups %xmm0,(%r14)
> 0x000000080149e6e4 <check_deferred_signal+148>: movups 0x40(%r15),%xmm0
> 0x000000080149e6e9 <check_deferred_signal+153>: movaps %xmm0,-0x50(%rbp)
> 0x000000080149e6ed <check_deferred_signal+157>: movups (%r15),%xmm0
> 0x000000080149e6f1 <check_deferred_signal+161>: movups 0x10(%r15),%xmm1
> 0x000000080149e6f6 <check_deferred_signal+166>: movups 0x20(%r15),%xmm2
> 0x000000080149e6fb <check_deferred_signal+171>: movups 0x30(%r15),%xmm3
> 0x000000080149e700 <check_deferred_signal+176>: movaps %xmm3,-0x60(%rbp)
> 0x000000080149e704 <check_deferred_signal+180>: movaps %xmm2,-0x70(%rbp)
> 0x000000080149e708 <check_deferred_signal+184>: movaps %xmm1,-0x80(%rbp)
> 0x000000080149e70c <check_deferred_signal+188>: movaps %xmm0,-0x90(%rbp)
> 0x000000080149e713 <check_deferred_signal+195>: movl   $0x0,0x100(%rbx)
> 0x000000080149e71d <check_deferred_signal+205>: mov    -0x90(%rbp),%esi
> 0x000000080149e723 <check_deferred_signal+211>: lea    -0x40(%rbp),%rdi
> 0x000000080149e727 <check_deferred_signal+215>: lea    -0x90(%rbp),%rdx
> 0x000000080149e72e <check_deferred_signal+222>: mov    %r14,%rcx
> 0x000000080149e731 <check_deferred_signal+225>: callq  0x80149f390 <handle_signal>
> 0x000000080149e736 <check_deferred_signal+230>: jmpq   0x80149e672 <check_deferred_signal+34>
> 0x000000080149e73b <check_deferred_signal+235>: movl   $0x0,0x180(%rbx)
> 0x000000080149e745 <check_deferred_signal+245>: jmpq   0x80149e672 <check_deferred_signal+34>
> End of assembler dump.
> 
> 
> I've kept a copy of the vim binary and also the core file, so this time I can answer any further questions much faster. ;)
> 
> I can't help much with those assembler part. But I've looked into /usr/src/lib/libthr/thread/thr_sig.c and there is alloca used at line 330:
> 
>    330      uc = alloca(uc_len);
>    331      getcontext(uc);
> 
> I would bet using malloc and check for NULL will help to fix this problem. Well, there will be a free needed before return and one at the end of check_deferred_signal, but that's better than an unsafe alloca.
> 
You would be wrong.

It seems that there is a recursion into rtld which cannot work when returning
from the signal.  Try the following patch, but I am unsure how easy is to
see whether the patch helps.

diff --git a/lib/libthr/thread/thr_sig.c b/lib/libthr/thread/thr_sig.c
index a6d021f..ebb6c58 100644
--- a/lib/libthr/thread/thr_sig.c
+++ b/lib/libthr/thread/thr_sig.c
@@ -30,6 +30,7 @@
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/signalvar.h>
+#include <sys/syscall.h>
 #include <signal.h>
 #include <errno.h>
 #include <stdlib.h>
@@ -257,7 +258,7 @@ handle_signal(struct sigaction *actp, int sig, siginfo_t *info, ucontext_t *ucp)
 	/* reschedule cancellation */
 	check_cancel(curthread, &uc2);
 	errno = err;
-	__sys_sigreturn(&uc2);
+	syscall(SYS_sigreturn, &uc2);
 }
 
 void



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150703211111.GZ2080>