DynamoRIO / DynamoRIO/dynamorio

CRASH: SIGSEGV on sigreturn under QEMU for AArch64-on-x86

Open
#7,371 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

This is another QEMU failure that happens on Ubuntu22 hit for #7270 but which did not happen on Ubuntu20.
This happens in a target-AArch64 build on an x86 machine.

These tests hit it among those labeled RUNS_ON_QEMU:
```
$ ctest -j 10 -L RUNS_ON_QEMU
96% tests passed, 4 tests failed out of 94
The following tests FAILED:
79 - code_api|linux.signal_racesys (Failed)
124 - code_api|client.exception (Failed)
163 - code_api|client.drx_buf-test (Failed)
172 - code_api|client.drreg-test (Failed)
```

client.exception is #7297.

Actually on GA two of those are ignored so only signal_racesys shows up as a failure:
```
(ignore: i#6260) code_api|client.drx_buf-test
(ignore: i#6260) code_api|client.drreg-test
```
#6260 was filed after failures showed up after the SVE patch.

These all crash the same way:
```
+0x28(%x28)[8byte]
0x0000005504889d84 f9401f85 ldr +0x38(%x28)[8byte] -> %x5
```
```
main_signal_handler: thread=268657, sig=11, xsp=0x0000005544943da0, retaddr=0x000000000000000b
siginfo: sig = 11, pid = 0, status = 0, errno = 0, si_code = 128
computing memory target for 0x0000005504889d80 causing SIGSEGV, kernel claims it is 0x0000000000000000
opnd_compute_address for: +0x28(%x28)
base => 0x00000055448f3000
index,scale => 0x00000055448f3000
disp => 0x00000055448f3028
For SIGSEGV at cache pc 0x0000005504889d80, computed target write 0x0000000000000000
faulting instr: str %x5 -> +0x28(%x28)[8byte]
```
That's si_code==128==0x80==SI_KERNEL.

So kernel is raising SIGSEGV on SYS_sigreturn: something is wrong with the frame.

Could it be that all DR sigreturns crash this way on this version of QEMU and just most of RUNS_ON_QEMU tests don't have signals?

I tried signal1000 and it works under QEMU w/o DR but hits same 0x*d80 crash
w/ DR:
```
$ /usr/bin/qemu-aarch64 "-L" "/usr/aarch64-linux-gnu" suite/tests/bin/linux.signal1000
Sending SIGUSR2
Sending SIGUSR1
in signal handler
Got SIGUSR1
Sending SIGRTMAX
in signal handler
Got SIGRTMAX
Generating SIGSEGV
in signal handler
Got SIGSEGV
250006.902505

$ /usr/bin/qemu-aarch64 "-L" "/usr/aarch64-linux-gnu" bin64/drrun "-xarch_root" "/usr/aarch64-linux-gnu" -- suite/tests/bin/linux.signal1000

...
Sending SIGUSR2
Sending SIGUSR1
in signal handler
Got SIGUSR1

```

I tried aligning the sigcontext from 16 to 32 and 64 bytes: same failure.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.