blob: 42ef805341fda3e273525471ed74d716bc4930b2 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
mistranslation: 0.990
user-level: 0.938
x86: 0.910
performance: 0.750
device: 0.740
semantic: 0.739
graphic: 0.724
vnc: 0.657
debug: 0.634
architecture: 0.613
ppc: 0.601
peripherals: 0.581
network: 0.520
permissions: 0.507
socket: 0.506
PID: 0.476
VMM: 0.449
register: 0.433
hypervisor: 0.432
risc-v: 0.423
files: 0.422
kernel: 0.419
i386: 0.414
TCG: 0.413
virtual: 0.330
boot: 0.277
arm: 0.238
KVM: 0.215
assembly: 0.158
--------------------
debug: 0.965
x86: 0.947
user-level: 0.885
hypervisor: 0.569
virtual: 0.264
TCG: 0.122
files: 0.036
PID: 0.023
performance: 0.023
network: 0.018
semantic: 0.015
register: 0.011
kernel: 0.009
device: 0.007
assembly: 0.005
socket: 0.005
ppc: 0.004
architecture: 0.004
VMM: 0.004
KVM: 0.003
peripherals: 0.003
graphic: 0.002
boot: 0.002
permissions: 0.002
vnc: 0.001
i386: 0.001
risc-v: 0.001
mistranslation: 0.001
arm: 0.000
qemu-user -g xxx -E LD_PROFILE=xxx segfault
Here is two simple steps to reproduce the bug:
$ qemu-x86_64 -E LD_PROFILE=libc.so.6 -E LD_PROFILE_OUTPUT=. -g 12345 -L / /bin/ls
(libc.so and /bin/ls might change on your system, in this case we just need a binary with a profilable needed library)
In a other window launch:
$ gdb
(gdb) target remote :12345
(gdb) c
At this point qemu will segfault.
It seems this problem is appends when sigprof passed to gdb.
One way I have found to bypass this:
patch gdbstub.c gdb_handlesig and ignore sig if
sig == TARGET_SIGPROF
(which means now I can't catch sigprof on gdb anymore)
We were mis-parsing the 'vCont' packet in the gdb protocol, so when gdb told us "send a SIGPROF (0x1b)" we skipped the first digit in the hex signal number and interpreted it as "send an 0xb", which happens to be SIGSEGV.
Should be fixed by this:
https://<email address hidden>/
https://gitlab.com/qemu-project/qemu/-/commit/3ddd9036389f5f577e09
|
