[Qemu-devel] [Bug 1346769] [NEW] /proc/self/maps content returned to 32-bits guest under 64-bits qemu

[Mikhail Ilyin]

Public bug reported:

Reading /proc/self/maps a user doesn't get a stack record. Not all
programs relies on the maps file but some do.

The bug found by running 32-bits binaries with address sanitizer (Asan)
instrumentations under 64-bit qemu.

$ echo "int main() { return 0; }" > /tmp/test.c
$ gcc -m32 -fsanitize=address -fno-common -Wall -g -fPIC -o /tmp/test 
/tmp/test.c
$ qemu-i386-static /tmp/test
==4092==AddressSanitizer CHECK failed: 
/home/michail/Downloads/gcc-4.9.0/libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:63
 "(((uptr)&rl >= start && (uptr)&rl < end)) != (0)" (0x0, 0x0)
    #0 0xf632ff01 (/home/michail/build/lib32/libasan.so.1+0x53f01)
    #1 0xf6333f49 (/home/michail/build/lib32/libasan.so.1+0x57f49)
    #2 0xf6338785 (/home/michail/build/lib32/libasan.so.1+0x5c785)
    #3 0xf6338bd1 (/home/michail/build/lib32/libasan.so.1+0x5cbd1)
    #4 0xf6331baf (/home/michail/build/lib32/libasan.so.1+0x55baf)
    #5 0xf6331dca (/home/michail/build/lib32/libasan.so.1+0x55dca)
    #6 0xf6331f5a (/home/michail/build/lib32/libasan.so.1+0x55f5a)
    #7 0xf6330bd4 (/home/michail/build/lib32/libasan.so.1+0x54bd4)
    #8 0xf67ebeec (/lib/ld-linux.so.2+0xeeec)
    #9 0xf67de10e (/lib/ld-linux.so.2+0x110e)

This happened because during initialization Asan can't find stack
boundaries.

For some reasons Qemu wants to report stack boundaries just for several
arch targets skipping other ones. This is from linux-user/syscall.c
open_self_maps()

#if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_UNICORE32)
    dprintf(fd, "%08llx-%08llx rw-p %08llx 00:00 0          [stack]\n",
                (unsigned long long)ts->info->stack_limit,
                (unsigned long long)(ts->info->start_stack +
                                     (TARGET_PAGE_SIZE - 1)) & TARGET_PAGE_MASK,
                (unsigned long long)0);
#endif

Not very clear why the case covers just specific targets.

This bug continues the previously reported issue with not hiden system
map http://lists.nongnu.org/archive/html/qemu-
devel/2014-07/msg02793.html.

** Affects: qemu
     Importance: Undecided
         Status: New

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1346769

Title:
  /proc/self/maps content returned to 32-bits guest under 64-bits qemu

Status in QEMU:
  New

Bug description:
  Reading /proc/self/maps a user doesn't get a stack record. Not all
  programs relies on the maps file but some do.

  The bug found by running 32-bits binaries with address sanitizer
  (Asan) instrumentations under 64-bit qemu.

  $ echo "int main() { return 0; }" > /tmp/test.c
  $ gcc -m32 -fsanitize=address -fno-common -Wall -g -fPIC -o /tmp/test 
/tmp/test.c
  $ qemu-i386-static /tmp/test
  ==4092==AddressSanitizer CHECK failed: 
/home/michail/Downloads/gcc-4.9.0/libsanitizer/sanitizer_common/sanitizer_linux_libcdep.cc:63
 "(((uptr)&rl >= start && (uptr)&rl < end)) != (0)" (0x0, 0x0)
      #0 0xf632ff01 (/home/michail/build/lib32/libasan.so.1+0x53f01)
      #1 0xf6333f49 (/home/michail/build/lib32/libasan.so.1+0x57f49)
      #2 0xf6338785 (/home/michail/build/lib32/libasan.so.1+0x5c785)
      #3 0xf6338bd1 (/home/michail/build/lib32/libasan.so.1+0x5cbd1)
      #4 0xf6331baf (/home/michail/build/lib32/libasan.so.1+0x55baf)
      #5 0xf6331dca (/home/michail/build/lib32/libasan.so.1+0x55dca)
      #6 0xf6331f5a (/home/michail/build/lib32/libasan.so.1+0x55f5a)
      #7 0xf6330bd4 (/home/michail/build/lib32/libasan.so.1+0x54bd4)
      #8 0xf67ebeec (/lib/ld-linux.so.2+0xeeec)
      #9 0xf67de10e (/lib/ld-linux.so.2+0x110e)

  This happened because during initialization Asan can't find stack
  boundaries.

  For some reasons Qemu wants to report stack boundaries just for
  several arch targets skipping other ones. This is from linux-
  user/syscall.c open_self_maps()

  #if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_UNICORE32)
      dprintf(fd, "%08llx-%08llx rw-p %08llx 00:00 0          [stack]\n",
                  (unsigned long long)ts->info->stack_limit,
                  (unsigned long long)(ts->info->start_stack +
                                       (TARGET_PAGE_SIZE - 1)) & 
TARGET_PAGE_MASK,
                  (unsigned long long)0);
  #endif

  Not very clear why the case covers just specific targets.

  This bug continues the previously reported issue with not hiden system
  map http://lists.nongnu.org/archive/html/qemu-
  devel/2014-07/msg02793.html.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1346769/+subscriptions