Skip to content

Commit e379a71

Browse files
clayborgaaryanshukla
authored andcommitted
[lldb] Fix a bug for PT_TLS segments getting loaded when they shouldn't. (llvm#98432)
PT_LOAD and PT_TLS segments are top level sections in the ObjectFileELF section list. The two segments can often have the same program header p_vaddr and p_paddr values and this can cause section load list issues in LLDB if we load the PT_TLS segments. What happens is the SectionLoadList::m_addr_to_sect, when a library is loaded, will first map one of the sections named "PT_LOAD[0]" with the load address that matches the p_vaddr entry from the program header. Then the "PT_TLS[0]" would come along and try to load this section at the same address. This would cause the "PT_LOAD[0]" section to be unloaded as the SectionLoadList::m_addr_to_sect would replace the value for the matching p_vaddr with the last section to be seen. The sizes of the PT_TLS and PT_LOAD that have the same p_vaddr value don't need to have the same byte size, so this could cause lookups to fail for an addresses in the "PT_LOAD[0]" section or any of its children if the offset is greater than the offset size of the PT_TLS segment. It could also cause us to incorrectly attribute addresses from the "PT_LOAD[0]" to the "PT_TLS[0]" segment when doing lookups for offset that are less than the size of the PT_TLS segment. This fix stops us from loading PT_TLS segments in the section load lists and will prevent the bugs that resulted from this. No addresses the the DWARF refer to TLS data with a "file address" in any way. They all have TLS DWARF location expressions to locate these variables. We also don't have any support for having actual thread specific sections and having those sections resolve to something different for each thread, so there currently is no point in loading thread specific sections. Both the ObjectFileMachO and ObjectFileCOFF both ignore thread specific sections at the moment, so this brings the ObjectFileELF to parity with those plug-ins. I added a test into an existing test to verify that things work as expected. Prior to this fix with a real binary, the output of "target dump section-load-list" would look like this for the old LLDB: ``` // (lldb) target dump section-load-list // addr = 0x0000000000000000, section = 0x55d46ab8c510: 0xfffffffffffffffd container [0x0000000000000000-0x0000000000000628) r-- 0x00000000 0x00000628 0x00000000 a.out.PT_LOAD[0] // addr = 0x0000000000001000, section = 0x55d46ab8b0c0: 0xfffffffffffffffc container [0x0000000000001000-0x0000000000001185) r-x 0x00001000 0x00000185 0x00000000 a.out.PT_LOAD[1] // addr = 0x0000000000002000, section = 0x55d46ac040f0: 0xfffffffffffffffb container [0x0000000000002000-0x00000000000020cc) r-- 0x00002000 0x000000cc 0x00000000 a.out.PT_LOAD[2] // addr = 0x0000000000003db0, section = 0x55d46ab7cef0: 0xfffffffffffffff6 container [0x0000000000003db0-0x0000000000003db4) r-- 0x00002db0 0x00000000 0x00000000 a.out.PT_TLS[0] ``` And this for the fixed LLDB: ``` // (lldb) target dump section-load-list // addr = 0x0000000000000000, section = 0x105f0a9a8: 0xfffffffffffffffd container [0x0000000000000000-0x0000000000000628) r-- 0x00000000 0x00000628 0x00000000 a.out.PT_LOAD[0] // addr = 0x0000000000001000, section = 0x105f0adb8: 0xfffffffffffffffc container [0x0000000000001000-0x0000000000001185) r-x 0x00001000 0x00000185 0x00000000 a.out.PT_LOAD[1] // addr = 0x0000000000002000, section = 0x105f0af48: 0xfffffffffffffffb container [0x0000000000002000-0x00000000000020cc) r-- 0x00002000 0x000000cc 0x00000000 a.out.PT_LOAD[2] // addr = 0x0000000000003db0, section = 0x105f0b078: 0xfffffffffffffffa container [0x0000000000003db0-0x0000000000004028) rw- 0x00002db0 0x00000274 0x00000000 a.out.PT_LOAD[3] ``` We can see that previously the "PT_LOAD[3]" segment would be removed from the section load list, and after the fix it remains and there is on PT_TLS in the loaded sections.
1 parent 2d94b00 commit e379a71

File tree

2 files changed

+41
-2
lines changed

2 files changed

+41
-2
lines changed

lldb/source/Plugins/ObjectFile/ELF/ObjectFileELF.cpp

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -717,6 +717,20 @@ bool ObjectFileELF::SetLoadAddress(Target &target, lldb::addr_t value,
717717
// Iterate through the object file sections to find all of the sections
718718
// that have SHF_ALLOC in their flag bits.
719719
SectionSP section_sp(section_list->GetSectionAtIndex(sect_idx));
720+
721+
// PT_TLS segments can have the same p_vaddr and p_paddr as other
722+
// PT_LOAD segments so we shouldn't load them. If we do load them, then
723+
// the SectionLoadList will incorrectly fill in the instance variable
724+
// SectionLoadList::m_addr_to_sect with the same address as a PT_LOAD
725+
// segment and we won't be able to resolve addresses in the PT_LOAD
726+
// segment whose p_vaddr entry matches that of the PT_TLS. Any variables
727+
// that appear in the PT_TLS segments get resolved by the DWARF
728+
// expressions. If this ever changes we will need to fix all object
729+
// file plug-ins, but until then, we don't want PT_TLS segments to
730+
// remove the entry from SectionLoadList::m_addr_to_sect when we call
731+
// SetSectionLoadAddress() below.
732+
if (section_sp->IsThreadSpecific())
733+
continue;
720734
if (section_sp->Test(SHF_ALLOC) ||
721735
section_sp->GetType() == eSectionTypeContainer) {
722736
lldb::addr_t load_addr = section_sp->GetFileAddress();

lldb/test/Shell/ObjectFile/ELF/PT_TLS-overlap-PT_LOAD.yaml

Lines changed: 27 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,20 @@
1-
# Overlapping PT_LOAD and PT_TLS segments should be able to exist side by side.
1+
# Overlapping PT_LOAD and PT_TLS segments in an object file should be able to
2+
# exist side by side.
3+
4+
# When an ELF file contains both PT_LOAD and PT_TLS segments where the PT_TLS
5+
# segment has the same p_vaddr and p_paddr as a PT_LOAD segment, this
6+
# was causing LLDB, when loading a ELF object file at an address, to overwrite
7+
# the section load address for a PT_LOAD that shares the same p_vaddr value in
8+
# the section load list's addr to section map for this code. This test ensures
9+
# that no PT_TLS segments get loaded and can't interfere with real segments we
10+
# need to resolved as all access to thread specific memory is only done via
11+
# DWARF location expressions. We also don't have any code that loads any thread
12+
# specific segments at a different address for different threads, so there is
13+
# no reason currently to try and load thread specific segments.
214

315
# RUN: yaml2obj %s -o %t
416
# RUN: lldb-test object-file %t | FileCheck %s
5-
# RUN: %lldb %t -o "image lookup -a 0x1000" -b | FileCheck --check-prefix=LOOKUP %s
17+
618

719
# CHECK: Index: 0
820
# CHECK-NEXT: ID: 0xffffffffffffffff
@@ -26,8 +38,21 @@
2638
# CHECK-NEXT: File size: 0
2739
# CHECK-NEXT: Showing 1 subsections
2840

41+
# RUN: %lldb %t -b \
42+
# RUN: -o "image lookup -a 0x1000" \
43+
# RUN: -o "target modules load --file %t --slide 0" \
44+
# RUN: -o "image lookup -a 0x1000" \
45+
# RUN: -o "target dump section-load-list" \
46+
# RUN: | FileCheck --check-prefix=LOOKUP %s
47+
2948
# LOOKUP-LABEL: image lookup -a 0x1000
3049
# LOOKUP: Address: {{.*}}.PT_LOAD[0]..data + 0)
50+
# LOOKUP: target modules load
51+
# LOOKUP: image lookup -a 0x1000
52+
# LOOKUP: Address: {{.*}}.PT_LOAD[0]..data + 0)
53+
# LOOKUP: target dump section-load-list
54+
# LOOKUP: PT_TLS-overlap-PT_LOAD.yaml.tmp.PT_LOAD[0]
55+
# LOOKUP-NOT: PT_TLS-overlap-PT_LOAD.yaml.tmp.PT_TLS[0]
3156

3257
!ELF
3358
FileHeader:

0 commit comments

Comments
 (0)