• Bug#1101361: ltrace crashes when attaching to a process that links a de

    From Adam Rice@21:1/5 to All on Wed Mar 26 15:10:02 2025
    Package: ltrace
    Version: 0.7.3+git20240814-0.3
    Severity: normal
    Tags: upstream
    X-Debbugs-Cc: ricea@google.com

    Dear Maintainer,

    *** Reporter, please consider answering these questions, where appropriate ***

    * What led up to the situation?

    emacs was hung with 100% CPU utilisation. I wanted to know why.

    * What exactly did you do (or not do) that was effective (or
    ineffective)?

    I attempted to diagnose the problem using "ltrace -p".

    * What was the outcome of this action?

    ltrace crashed because one of the libraries that emacs linked against wasn't present in the filesystem, probably because it had been upgraded.

    * What outcome did you expect instead?

    ltrace shows me what emacs is doing (or nothing if emacs is just spinning inside
    its own code).

    I wrote this shell script to reproduce the issue

    """
    #!/bin/sh -e

    cd `mktemp -d`
    echo "===> Building in $PWD ..."

    cat <<__END__ > lib.h
    void DoNothing();
    __END__

    cat <<__END__ > lib.c
    #include "lib.h"

    void DoNothing() {}
    __END__

    gcc -shared -O -o liblib.so -Wall -Werror -fPIC lib.c

    cat <<__END__ > main.c
    #include <stdio.h>
    #include <stdlib.h>
    #include <unistd.h>

    #include "lib.h"

    int main() {
    if (unlink("liblib.so") == -1) {
    perror("unlink liblib.so");
    exit(1);
    }
    while (1) {
    sleep(1);
    DoNothing();
    }
    return 0;
    }
    __END__

    gcc -L$PWD -Wl,-rpath=$PWD -Wall -Werror -O -o bin main.c -llib

    ./bin &

    echo "===> Running ltrace -p $! ..."
    ltrace -p $!
    """

    /proc/sys/kernel/yama/ptrace_scope must contain the value 0 for this to work.

    Sample output:
    """
    Building in /tmp/tmp.oldWtch6po ...
    Running ltrace -p 4025257 ...
    Can't open /tmp/tmp.oldWtch6po/liblib.so: No such file or directory
    Couldn't determine base address of /tmp/tmp.oldWtch6po/liblib.so
    ltrace: ltrace-elf.c:426: ltelf_destroy: Assertion `(&lte->plt_relocs)->elt_size == sizeof(GElf_Rela)' failed.
    """

    Backtrace from gdb:
    """
    #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0)
    at ./nptl/pthread_kill.c:44
    #1 0x00007f63dfed3ebf in __pthread_kill_internal (threadid=<optimized out>, signo=6)
    at ./nptl/pthread_kill.c:78
    #2 0x00007f63dfe7fd82 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
    #3 0x00007f63dfe684f0 in __GI_abort () at ./stdlib/abort.c:79
    #4 0x00007f63dfe68418 in __assert_fail_base (
    fmt=0x7f63dffecca0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion@entry=0x557841e313e0 "(&lte->plt_relocs)->elt_size == sizeof(GElf_Rela)",
    file=file@entry=0x557841e331ec "ltrace-elf.c", line=line@entry=426,
    function=function@entry=0x557841e367d0 <__PRETTY_FUNCTION__.5> "ltelf_destroy") at ./assert/assert.c:96
    #5 0x00007f63dfe78692 in __assert_fail (
    assertion=assertion@entry=0x557841e313e0 "(&lte->plt_relocs)->elt_size == sizeof(GElf_Rela)",
    file=file@entry=0x557841e331ec "ltrace-elf.c", line=line@entry=426,
    function=function@entry=0x557841e367d0 <__PRETTY_FUNCTION__.5> "ltelf_destroy") at ./assert/assert.c:105
    #6 0x0000557841e0e07a in ltelf_destroy (lte=0x7ffd79d48fb0) at ./ltrace-elf.c:426
    #7 ltelf_destroy (lte=0x7ffd79d48fb0) at ./ltrace-elf.c:421
    #8 0x0000557841e0fa83 in read_module (lib=lib@entry=0x55785b1a97f0, proc=proc@entry=0x55785b1e5620,
    filename=filename@entry=0x7ffd79d49180 "/tmp/tmp.oldWtch6po/liblib.so", bias=<optimized out>,
    main=main@entry=0) at ./ltrace-elf.c:1180
    #9 0x0000557841e0fbec in ltelf_read_library (lib=lib@entry=0x55785b1a97f0, proc=proc@entry=0x55785b1e5620,
    filename=filename@entry=0x7ffd79d49180 "/tmp/tmp.oldWtch6po/liblib.so", bias=<optimized out>)
    at ./ltrace-elf.c:1290
    #10 0x0000557841e07caa in crawl_linkmap (proc=proc@entry=0x55785b1e5620, dbg=dbg@entry=0x7ffd79d4b1e0)
    at ./sysdeps/linux-gnu/proc.c:547
    #11 0x0000557841e08678 in linkmap_init (proc=proc@entry=0x55785b1e5620, dyn_addr=<optimized out>)
    at ./sysdeps/linux-gnu/proc.c:627
    #12 0x0000557841dfed35 in process_hit_start (proc=<optimized out>) at ./proc.c:537
    #13 0x0000557841dfef12 in open_pid (pid=4025257) at ./proc.c:597
    #14 0x0000557841dfccd7 in ltrace_init (argc=<optimized out>, argv=<optimized out>) at ./libltrace.c:141
    #15 0x0000557841dfc96d in main (argc=<optimized out>, argv=<optimized out>) at ./main.c:47
    """

    *** End of the template - remove these template lines ***


    -- System Information:
    Debian Release: rodete
    Architecture: amd64 (x86_64)
    Foreign Architectures: i386

    Kernel: Linux 6.10.11-1rodete2-amd64 (SMP w/64 CPU threads; PREEMPT)
    Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
    Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en_US
    Shell: /bin/sh linked to /usr/bin/bash
    Init: systemd (via /run/systemd/system)
    LSM: AppArmor: enabled

    Versions of packages ltrace depends on:
    ii libc6 2.40-6+gl0
    ii libelf1t64 0.192-4
    ii libselinux1 3.7-3

    ltrace recommends no packages.

    ltrace suggests no packages.

    -- no debconf information

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From =?utf-8?B?0L3QsNCx?=@21:1/5 to Adam Rice on Wed Mar 26 16:30:02 2025
    On Wed, Mar 26, 2025 at 10:59:58PM +0900, Adam Rice wrote:
    Package: ltrace
    Version: 0.7.3+git20240814-0.3
    Severity: normal
    Tags: upstream
    X-Debbugs-Cc: ricea@google.com

    Sample output:
    """
    Building in /tmp/tmp.oldWtch6po ...
    Running ltrace -p 4025257 ...
    Can't open /tmp/tmp.oldWtch6po/liblib.so: No such file or directory
    Couldn't determine base address of /tmp/tmp.oldWtch6po/liblib.so
    ltrace: ltrace-elf.c:426: ltelf_destroy: Assertion `(&lte->plt_relocs)->elt_size == sizeof(GElf_Rela)' failed.
    """
    Funnily enough, this is the last line in
    void
    ltelf_destroy(struct ltelf *lte)
    {
    debug(DEBUG_FUNCTION, "close_elf()");
    elf_end(lte->elf);
    close(lte->fd);
    VECT_DESTROY(&lte->plt_relocs, GElf_Rela, NULL, NULL);
    }
    and removing it... fixes it?
    ===> Running ltrace -p 169396 ...
    Can't open /home/nabijaczleweli/uwu/repro/ltrace/liblib.so: No such file or directory
    Couldn't determine base address of /home/nabijaczleweli/uwu/repro/ltrace/liblib.so
    Couldn't load ELF object /home/nabijaczleweli/uwu/repro/ltrace/liblib.so: Bad file descriptor
    Can't open /home/nabijaczleweli/uwu/repro/ltrace/liblib.so: No such file or directory
    Couldn't determine base address of /home/nabijaczleweli/uwu/repro/ltrace/liblib.so
    Couldn't load ELF object /home/nabijaczleweli/uwu/repro/ltrace/liblib.so: Bad file descriptor
    DoNothing(0, 0, 0, 0x545634c3) = 0
    sleep(1, 0, 0, 0x545634c3) = 0
    DoNothing(0, 0, 0, 0x545634c3) = 0

    ...because it's never been initialised
    (gdb) p lte->plt_relocs
    $2 = {data = 0x0, size = 0, allocated = 0, elt_size = 0}

    This is a trivial fix:
    https://salsa.debian.org/debian/ltrace/-/commit/f09d0e437e506718f8198143f9be95e94dd6792a

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEfWlHToQCjFzAxEFjvP0LAY0mWPEFAmfkG7wACgkQvP0LAY0m WPE2fw//ceIQOTo0k6+zhswKiAPo8DhUy9tiu68s3tV5rLKyT1EvPvbK7jgu8smO I4r3ZuwEwEJZIzR+Xil+6JPD9i90avG1FpnHmwTtg6hGsl6hJWoacgqEuptS+BlQ 5zU2AmCNwb47EiYUGQ2oV5ldyPD9tPK+d9YNK7V7JOMo47hOu8WT+1FpbJkv4Hcg DFDgL+cKd+0NaMXUrGhpC+lxB0Tk/BUlKt6G9JqSCj0DHy6alBnQb/VkwYrIcmRv OLePqL8/6b1YeKciUDEtd7cJajhGIFhV/wLbKk6rleaAB+rVfv+CTd9Pm7MK4b4I bg3KzsGdcE7em+UTEWgza1nV+qtdqM6NWitkL2Si9TGchOuJ6ag/EuGJmKGvAtud WFWOM107+XUwLqjR+8YpufNg/gnt14FfhejxMZxW5Na3Aw8S976yFAx0QnhyTmzV yMpJfUEG9f4deNDbsBBC7hJO0qGcJpnL8iYz5LR1OXCtBd061E9Q2fMr7EQt0SZB IosRAG2Hl1Uri/fsvHr0W+PJfvTFzy9EXTqZNg6Ocb9CC4vs4LPmWKuHgs8CMtMr jRNbLLS6GUuO4iOQ+2mUaBx0cxw7Scm8FB+7Dr8ULRRgmhVqeXWbFWfqHwZCJ5gp uFMQYL8cfPzyJEyEGDF01S5vs2MBXeRNuC7uPzEMP9wp641f9rI=
    =wTum
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)