DynamoRIO / DynamoRIO/dynamorio

run an application with drrun the drrun will be terimated by an ASSERT !code->writable

Open
#5,244 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

1. DR with --loglevel 3 information
when i run my application uds-stack using the following method:
drrun with gdb use arguments uds-stack, the drrun terimated by an ASSERT like the following:
the following is the output by DR with --loglevel 3
```
Thread 3 "uds-stack" received signal SIGSEGV, Segmentation fault.
[Switching to LWP 2471]
0x54c2fbb2 in protect_generated_code (code_in=0x479b2000, writable=true)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/arch/arch.c:1518
1518 /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/arch/arch.c: No such file or directory.
(gdb) bt
#0 0x54c2fbb2 in protect_generated_code (code_in=0x479b2000, writable=true)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/arch/arch.c:1518
#1 0x54c39452 in update_indirect_branch_lookup (dcontext=0x479d5dc0)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/arch/emit_utils_shared.c:3304
#2 0x54c2fa36 in update_generated_hashtable_access (dcontext=0x479d5dc0)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/arch/arch.c:1493
#3 0x54af20a2 in hashtable_ibl_resized_custom (dcontext=0x479d5dc0, table=0x479d6b34, old_capacity=129,
old_table=0x47b815c0, old_table_unaligned=0x47b815a8, old_ref_count=4294967295, old_table_flags=150)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/fragment.c:1071
#4 0x54aea98a in hashtable_ibl_check_size (dcontext=0x479d5dc0, table=0x479d6b34, add_now=1, add_later=0)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/hashtablex.h:1162
#5 0x54ae9a3a in hashtable_ibl_add (dcontext=0x479d5dc0, e=..., table=0x479d6b34)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/hashtablex.h:780
#6 0x54afbc82 in fragment_add_ibl_target_helper (dcontext=0x479d5dc0, f=0x47a7fad8, ibl_table=0x479d6b34)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/fragment.c:4060
#7 0x54afc682 in fragment_add_ibl_target (dcontext=0x479d5dc0,
tag=0x76ca640c "\212\001p\343|\004\v\345p$\033\345\310\064\033\345\\\006", branch_type=IBL_RETURN)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/fragment.c:4231
#8 0x54b3f78e in dispatch_exit_fcache (dcontext=0x479d5dc0)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/dispatch.c:1161
#9 0x54b3f68a in dispatch_enter_dynamorio (dcontext=0x479d5dc0)
at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/dispatch.c:1011
#10 0x54b3b4a8 in d_r_dispatch (dcontext=0x479d5dc0) at /work/dynamorio/dynamorio-cronbuild-8.0.18942-1/core/dispatch.c:160
#11 0x76ca640c in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

0x54c2fba6 <+360>: add r3, pc
0x54c2fba8 <+362>: mov r0, r3
0x54c2fbaa <+364>: bl 0x54b50bcc
0x54c2fbae <+368>: ldr r3, [r7, #16]
0x54c2fbb0 <+370>: ldrb r2, [r7, #3]
**=> 0x54c2fbb2 <+372>: strb.w r2, [r3, #3677] ; 0xe5d**
0x54c2fbb6 <+376>: nop
0x54c2fbb8 <+378>: adds r7, #24
0x54c2fbba <+380>: mov sp, r7
0x54c2fbbc <+382>: pop {r4, r5, r7, pc}
0x54c2fbbe <+384>: nop
0x54c2fbc0 <+386>: subs.w r0, r0, #9961472 ; 0x980000
0x54c2fbc4 <+390>: lsls r4, r5, #4
0x54c2fbc6 <+392>: movs r0, r0
0x54c2fbc8 <+394>: stmia r3!, {r1, r6, r7}
0x54c2fbca <+396>: movs r0, r2
0x54c2fbcc <+398>: stmia r0!, {r2, r3}
0x54c2fbce <+400>: movs r0, r2
0x54c2fbd0 <+402>: lsls r4, r4, #10
0x54c2fbd2 <+404>: movs r0, r0
0x54c2fbd4 <+406>: stmia r2!, {r2, r4, r5, r6, r7}
0x54c2fbd6 <+408>: movs r0, r2
0x54c2fbd8 <+410>: itee cs
0x54c2fbda <+412>: movcs r0, r2
End of assembler dump.
(gdb) info registers
r0 0x1 1
r1 0x4797e138 1201135928
r2 0x1 1
r3 0x479b2000 1201348608
r4 0x54dbf000 1423699968
r5 0x479b2e6c 1201352300
r6 0x14 20
r7 0x47b6eb30 1203170096
r8 0x54dbf000 1423699968
r9 0x0 0
r10 0x47b71000 1203179520
r11 0x54b3b447 1421063239
r12 0x479d239c 1201480604
sp 0x47b6eb30 0x47b6eb30
lr 0x54b5315f 1421160799
pc 0x54c2fbb2 0x54c2fbb2
cpsr 0x60070030 1611071536
fpscr 0x0 0

```
Source code corresponding to the crash point
the source code line 1518 corresponding to the crash point
```

1496 void
1497 protect_generated_code(generated_code_t *code_in, bool writable)
1498 {
1499 /* i#936: prevent cl v16 (VS2010) from combining the two code->writable
1500 * stores into one prior to the change_protection() call and from
1501 * changing the conditionally-executed stores into always-executed
1502 * stores of conditionally-determined values.
1503 */
1504 volatile generated_code_t *code =
1505 (generated_code_t *)vmcode_get_writable_addr((byte *)code_in);
1506 if (TEST(SELFPROT_GENCODE, DYNAMO_OPTION(protect_mask)) &&
1507 code->writable != writable) {
1508 byte *genstart = (byte *)PAGE_START(code->gen_start_pc);
1509 if (!writable) {
1510 ASSERT(code->writable);
1511 code->writable = writable;
1512 }
1513 STATS_INC(gencode_prot_changes);
1514 change_protection(vmcode_get_writable_addr(genstart),
1515 code->commit_end_pc - genstart, writable);
1516 if (writable) {
1517 ASSERT(!code->writable);
**1518 code->writable = writable;**
1519 }
1520 }
1521 }

```
2、cpu information
Architecture: armv7l
Byte Order: Little Endian
CPU(s): 2
On-line CPU(s) list: 0,1
Thread(s) per core: 1
Core(s) per socket: 2
Socket(s): 1
Model name: ARMv7 Processor rev 10 (v7l)
CPU max MHz: 996.0000
CPU min MHz: 396.0000
OS: linux

3、dynamorio version
version 8.0.18967, custom build

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.