DynamoRIO / DynamoRIO/dynamorio

CRASH -- drrun all executables on ARM32 from LDREXB mangling bug

Open
#7,440 24 comments 0 reactions 1 assignee Claimed by @sab24 View on GitHub
Bug-DRCrash good first issue OpSys-ARM
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

Head version of dynamorio generates a SEGFAULT when running a simple drrun command both on rpi2 with armv7 and also with qemu userspace emulation.

glibc 2.41, gcc 14.2.1, Archlinux arm head

```
uname -an
Linux alarmpi 6.12.21-1-rpi #1 SMP Mon Mar 31 13:47:52 MDT 2025 armv7l GNU/Linux
```

```
git clone https://github.com/DynamoRIO/dynamorio.git
cd dynamorio
git submodule update --init
mkdir build && cd build
cmake ..
bin32/drrun -dumpcore_mask 0x8bff -- ls

Reading symbols from /usr/bin/ls...
(No debugging symbols found in /usr/bin/ls)
"/home/alarm/dynamorio/build/core" is not a core dump: file format not recognized
(gdb) No stack.
(gdb) Working directory /home/alarm/dynamorio/build.
(gdb) Segmentation fault (core dumped)
```

with debug build, coredump files (2 generated

[coredumps.tar.gz](https://github.com/user-attachments/files/19628533/coredumps.tar.gz)

) of this run are attached

```
mkdir builddebug && cd builddebug
cmake -DCMAKE_BUILD_TYPE=Debug ..
[alarm@alarmpi builddebug]$ bin32/drrun -debug -dumpcore_mask 0x8bff -- ls

<------------------------------------------->

<------------------------------------------->
Reading symbols from /usr/bin/ls...
(No debugging symbols found in /usr/bin/ls)
"/home/alarm/dynamorio/builddebug/core" is not a core dump: file format not recognized
(gdb) No stack.
(gdb) Working directory /home/alarm/dynamorio/builddebug.
(gdb) <------------------------------------------->

Segmentation fault (core dumped)
```

How to reproduce on X86:

```
cd ~/Downloads
git clone https://github.com/crosstool-ng/crosstool-ng
cd crosstool-ng
./bootstrap
./configure --enable-local
./ct-ng menuconfig
```
enable arm as target, select gcc newest version and glibc newest version. Enable C++ support for gcc so that libstdc++.so.6 will be built.
```
./ct-nt build
```

compile dynamorio, but first edit
make/toolchain_arm32.cmake
addd
```
set(TARGET_ABI "unknown-linux-gnueabi")
```
before the line
```
if (NOT DEFINED TARGET_ABI)
```

now compile dynamorio

```
-cd /home//Downloads/dynamorio && rm -rf ./buildarm
cd /home//Downloads/dynamorio && mkdir buildarm && cd buildarm && \
PATH=/home//x-tools/arm-unknown-linux-gnueabi2.30/bin/:$$PATH && \
cmake -DDEBUG=ON -DCMAKE_TOOLCHAIN_FILE=../make/toolchain-arm32.cmake -DCMAKE_C_LIBRARY_ARCHITECTURE=gnueabi -DBUILD_DOCS=NO -DTARGET_ABI='unknown-linux-gnueabi' -DCMAKE_SYSROOT=/home//x-tools/arm-unknown-linux-gnueabi2.30/arm-unknown-linux-gnueabi/sysroot/ -DZLIB_LIBRARY=/home//Downloads/zlib-arm-install/lib/libz.a -DZLIB_INCLUDE_DIR=/home//Downloads/zlib-arm-install/include/ .. && \
grep -r -l "arm-unknown-linux-gnueabi-as --sysroot" | xargs sed -i 's/arm-unknown-linux-gnueabi-as --sysroot=\/home\/\/x-tools\/arm-unknown-linux-gnueabi2\.30\/arm-unknown-linux-gnueabi\/sysroot\//arm-unknown-linux-gnueabi-as/' && \
make
```

Have qemu user mode emulation installed, and a basic arm executable ready.

```
export QEMU_LD_PREFIX=/home//x-tools/arm-unknown-linux-gnueabi/arm-unknown-linux-gnueabi/sysroot/
qemu-arm-static bin32/drrun -debug -dumpcore_mask 0x8bff -- /home//Downloads/busybox-1.37.0/_install/bin/ls
```

When using a client, there is a floating point exception

```
qemu-arm-static bin32/drrun -debug -dumpcore_mask 0x8bff -c api/bin/libmemval_simple.so -- /home//Downloads/busybox-1.37.0/_install/bin/ls
/Downloads/busybox-1.37.0/_install/bin/busybox (2992663)>
/Downloads/dynamorio/buildarm/api/bin/libmemval_simple.so;0;' -client_lib32 '/home//Downloads/dynamorio/buildarm/api/bin/libmemval_simple.so;0;' -code_api -dumpcore_mask 0x8bff -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct >

qemu: uncaught target signal 8 (Floating point exception) - core dumped
Floating point exception (core dumped)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.