Date: Tue, 27 Nov 2007 14:33:09 GMT From: Vasanth Rao Naik <vasanth.raonaik@gmail.com> To: freebsd-gnats-submit@FreeBSD.org Subject: i386/118285: Segmetation fault in reloc_non_plt. Message-ID: <200711271433.lAREX9bI003782@www.freebsd.org> Resent-Message-ID: <200711271440.lAREe18F011360@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 118285
>Category: i386
>Synopsis: Segmetation fault in reloc_non_plt.
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: freebsd-i386
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Tue Nov 27 14:40:00 UTC 2007
>Closed-Date:
>Last-Modified:
>Originator: Vasanth Rao Naik
>Release: FreeBSD 4.11
>Organization:
Juniper Networks India Pvt Ltd
>Environment:
FreeBSD bng-build22.juniper.net 4.11-RELEASE-p13 FreeBSD 4.11-RELEASE-p13 #2: Thu Jul 12 19:06:47 IST 2007 root@bng-build22.juniper.net:/usr/src/sys/compile/bng-build22 i386
>Description:
In reloc_non_plt(), find_symdef() sometimes returns invalid value in def and a null in defobjout. This causes any binary to recieve a segmentation fault and
cores. The kernel code where segmentation happens is
In reloc_non_plt
189 case R_386_GLOB_DAT:
190 {
191 const Elf_Sym *def;
192 const Obj_Entry *defobj;
193
194 def = find_symdef(ELF_R_SYM(rel->r_info), obj, &defobj,
195 false, cache);
196 if (def == NULL)
197 goto done;
198
199 *where = (Elf_Addr) (defobj->relocbase + def->st_value);
[vasanth] this is the point where we access defobj (NULL) and causes segmentation fault.
200 }
201 break;
I have recieved a core for rcp because of this issue. This issue was also been raised by someothers in the list.
http://lists.freebsd.org/pipermail/freebsd-current/2004-February/021698.html
The following kernel messages were thrown when problem happened
Nov 12 21:16:50 marx1 login: LOGIN_INFORMATION: User regress logged in from
host 192.168.64.68 on device ttyp0 Nov 12 21:16:50 marx1 su: regress to root on
/dev/ttyp0 Nov 12 21:16:51 marx1 /kernel: BAD_PAGE_FAULT: pid 3484 (df), uid 0:
pc 0x88100ea0 got a read fault at 0xc75aa65, x86 fault flags = 0x4 Nov 12
21:16:51 marx1 /kernel: Trapframe Register Dump:
Nov 12 21:16:51 marx1 /kernel: eax: 88143000 ecx: 0c75aa65 edx: 00000005 ebx:
8810f574
Nov 12 21:16:51 marx1 /kernel: esp: bfbfe930 ebp: bfbfe958 esi: 00000005 edi:
0c75aa55
Nov 12 21:16:51 marx1 /kernel: eip: 88100ea0 eflags: 00010206
Nov 12 21:16:51 marx1 /kernel: cs: 001f ss: 002f ds: 002f es: 002f
Nov 12 21:16:51 marx1 /kernel: fs: 002f trapno: 0000000c err: 00000004
Nov 12 21:16:51 marx1 /kernel: Page table info for PC address 0x88100ea0: PDE =
0xbb94067, PTE = 28aad425 Nov 12 21:16:51 marx1 /kernel: Dumping 16 bytes
starting at PC address 0x88100ea0:
Nov 12 21:16:51 marx1 /kernel: 83 7f 10 00 75 08 83 c1 04 83 39 00 74 f8 ba 01
>How-To-Repeat:
This problem is not always reproducible.
>Fix:
Please provide the Fix for this issue.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200711271433.lAREX9bI003782>