DynamoRIO / DynamoRIO/dynamorio
CRASH -- drrun all executables on ARM32 from LDREXB mangling bug
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
Head version of dynamorio generates a SEGFAULT when running a simple drrun command both on rpi2 with armv7 and also with qemu userspace emulation.
glibc 2.41, gcc 14.2.1, Archlinux arm head
```
uname -an
Linux alarmpi 6.12.21-1-rpi #1 SMP Mon Mar 31 13:47:52 MDT 2025 armv7l GNU/Linux
```
```
git clone https://github.com/DynamoRIO/dynamorio.git
cd dynamorio
git submodule update --init
mkdir build && cd build
cmake ..
bin32/drrun -dumpcore_mask 0x8bff -- ls
Reading symbols from /usr/bin/ls...
(No debugging symbols found in /usr/bin/ls)
"/home/alarm/dynamorio/build/core" is not a core dump: file format not recognized
(gdb) No stack.
(gdb) Working directory /home/alarm/dynamorio/build.
(gdb) Segmentation fault (core dumped)
```
with debug build, coredump files (2 generated
[coredumps.tar.gz](https://github.com/user-attachments/files/19628533/coredumps.tar.gz)
) of this run are attached
```
mkdir builddebug && cd builddebug
cmake -DCMAKE_BUILD_TYPE=Debug ..
[alarm@alarmpi builddebug]$ bin32/drrun -debug -dumpcore_mask 0x8bff -- ls
<------------------------------------------->
<------------------------------------------->
Reading symbols from /usr/bin/ls...
(No debugging symbols found in /usr/bin/ls)
"/home/alarm/dynamorio/builddebug/core" is not a core dump: file format not recognized
(gdb) No stack.
(gdb) Working directory /home/alarm/dynamorio/builddebug.
(gdb) <------------------------------------------->
Segmentation fault (core dumped)
```
How to reproduce on X86:
```
cd ~/Downloads
git clone https://github.com/crosstool-ng/crosstool-ng
cd crosstool-ng
./bootstrap
./configure --enable-local
./ct-ng menuconfig
```
enable arm as target, select gcc newest version and glibc newest version. Enable C++ support for gcc so that libstdc++.so.6 will be built.
```
./ct-nt build
```
compile dynamorio, but first edit
make/toolchain_arm32.cmake
addd
```
set(TARGET_ABI "unknown-linux-gnueabi")
```
before the line
```
if (NOT DEFINED TARGET_ABI)
```
now compile dynamorio
```
-cd /home//Downloads/dynamorio && rm -rf ./buildarm
cd /home//Downloads/dynamorio && mkdir buildarm && cd buildarm && \
PATH=/home//x-tools/arm-unknown-linux-gnueabi2.30/bin/:$$PATH && \
cmake -DDEBUG=ON -DCMAKE_TOOLCHAIN_FILE=../make/toolchain-arm32.cmake -DCMAKE_C_LIBRARY_ARCHITECTURE=gnueabi -DBUILD_DOCS=NO -DTARGET_ABI='unknown-linux-gnueabi' -DCMAKE_SYSROOT=/home//x-tools/arm-unknown-linux-gnueabi2.30/arm-unknown-linux-gnueabi/sysroot/ -DZLIB_LIBRARY=/home//Downloads/zlib-arm-install/lib/libz.a -DZLIB_INCLUDE_DIR=/home//Downloads/zlib-arm-install/include/ .. && \
grep -r -l "arm-unknown-linux-gnueabi-as --sysroot" | xargs sed -i 's/arm-unknown-linux-gnueabi-as --sysroot=\/home\/\/x-tools\/arm-unknown-linux-gnueabi2\.30\/arm-unknown-linux-gnueabi\/sysroot\//arm-unknown-linux-gnueabi-as/' && \
make
```
Have qemu user mode emulation installed, and a basic arm executable ready.
```
export QEMU_LD_PREFIX=/home//x-tools/arm-unknown-linux-gnueabi/arm-unknown-linux-gnueabi/sysroot/
qemu-arm-static bin32/drrun -debug -dumpcore_mask 0x8bff -- /home//Downloads/busybox-1.37.0/_install/bin/ls
```
When using a client, there is a floating point exception
```
qemu-arm-static bin32/drrun -debug -dumpcore_mask 0x8bff -c api/bin/libmemval_simple.so -- /home//Downloads/busybox-1.37.0/_install/bin/ls
/Downloads/busybox-1.37.0/_install/bin/busybox (2992663)>
/Downloads/dynamorio/buildarm/api/bin/libmemval_simple.so;0;' -client_lib32 '/home//Downloads/dynamorio/buildarm/api/bin/libmemval_simple.so;0;' -code_api -dumpcore_mask 0x8bff -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct >
qemu: uncaught target signal 8 (Floating point exception) - core dumped
Floating point exception (core dumped)
```
Contributor guide
Assessment
This issue has not been assessed yet.