DynamoRIO / DynamoRIO/dynamorio
CRASH - AArch64 dr_create_client_thread segmentation fault app_lib_tls
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
**Describe the bug**
Following the various setup functions required for the client to run, calling dr_create_client_thread on the main client thread segfaults as a result of a attempt to dereference the os_tls->app_lib_tls_base (core/unix/os.c:6400). The address points to NULL + Offset. Tracing this backwards it seems like DynamoRIO reads the tpidr_el0 register when calling get_segment_base however we do not appear to set this register at any point.
My assumption is that the intended behaviour is we create a TLS struct for the app within the os_tls_init function and are storing a pointer to this struct within the tpidr register however for some reason this is not happening on AArch64. I have been unable to narrow down the reason for this. Thus, when we attempt to read the register back within the os_switch_seg_to_context function, there is invalid TLS storage for the app.
I have not been able to test on x86 how the behaviour is expected to work however fairly sure this is specific to AArch64.
**To Reproduce**
Steps to reproduce the behavior:
1. On an AArch64 machine set-up a base client with the example .
2. Call dr_create_client_thread with some handler function.
3. DynamoRIO should segfault and exit.
Please also answer these questions:
- What happens when you run without any client?
-> Haven't been able to test
- What happens when you run with debug build ("-debug" flag to drrun/drconfig/drinject)?
Received SIGSEGV at pc 0x0000ffffaddc05b8 in thread 8619
Base: 0x0000ffffadad0000
Registers: eflags=0x0000000080000000
version 7.91.18278, custom build
0x0000ffffcfb5c850 0x0000ffffaddc0430
0x0000ffffcfb5c8e0 0x0000ffffaddb5fe8
0x0000ffffcfb5c900 0x0000ffffaddb8e80
0x0000ffffcfb5c920 0x0000000043cc1df0
0x0000ffffcfb5c980 0x0000ffffadc9a608
0x0000ffffcfb5ca50 0x0000ffffadaf9590
0x0000ffffcfb5ca90 0x0000ffffadde9368
0x0000ffffcfb5d2c0 0x0000ffffaddb23e0>
**Expected behavior**
The callback function to be executed on a seperate thread.
Contributor guide
Assessment
This issue has not been assessed yet.