Question for dbx.

[Franklin Li]

Hi All,

My program core dumped.

Below is dbx information:
************************************************************************
....
detected a multithreaded program
t@141 (l@141) terminated by signal BUS (object specific hardware error)
0xfe7d4150: strcat+0x0020: ldsb [%o1], %o0
current thread: t@141
=>[1] strcat(0x0, 0x41dadfeb, 0xf54fb2f9, 0xf54fb2f8, 0x0, 0x2400), at
0xfe7d4150
...
************************************************************************

It's caused by strcat?

And if it is, why strcat caused core dump?

The first address of strcat is 0x0. So the reason is passing null to strcat?

Thanks.

Franklin

[Seongbae Park]

Those 6 values are what's in %i0-%i5 registers
at the time of SIGBUS on strcat() stack frame.
They may or may not be what's passed to strcat()
since the function is free to change its %i registers.
However, most of the time, %i register contains what's passed.
Hence we can guess that the first parameter of strcat was 0x0
and the second parameter was 0x41dadfeb.

> So the reason is passing null to strcat?

Maybe, but I don't think so.
Something's not quite right
because ldsb can not trigger SIGBUS.
If the address for ldsb was bad,
It should have been SIGSEGV.

So there's not enough data to make any conclusion.
--
#pragma ident "Seongbae Park, compiler, http://blogs.sun.com/seongbae/"

[Andreas F. Borchert]

On 2005-08-26, Seongbae Park <Seongb...@Sun.COM> wrote:
> Something's not quite right
> because ldsb can not trigger SIGBUS.

This is usually correct but there are exceptions. One of these exceptions
are areas that are allocated using mmap(2). From the manual page of mmap(2):

A write into a MAP_NORESERVE mapping produces results which depend
on the current availability of swap space in the system. If space is
available, the write succeeds and a private copy of the written page
is created; if space is not available, the write fails and a SIGBUS
or SIGSEGV signal is delivered to the writing process.
[...]
References to whole pages following the end of an object will result
in the delivery of a SIGBUS or SIGSEGV signal. SIGBUS signals may
also be delivered on various file system conditions, including quota
exceeded errors.

Here is an example that demonstrates this:

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
int pagesize = getpagesize();
void* buf = malloc(pagesize);
memset(buf, 0, pagesize);
strcpy(buf, "this is a string");
int fd = open("mapped-file", O_RDWR|O_CREAT|O_TRUNC);
if (fd < 0) {
perror("mapped-file"); exit(1);
}
if (write(fd, buf, pagesize) < 0) {
perror("write"); exit(1);
}
void* p = mmap(0, pagesize,
PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
if (p == MAP_FAILED) {
perror("mmap"); exit(1);
}
ftruncate(fd, 0);
char* cp = (char *) p;
strcat(buf, cp);
}

And now we crash at exactly the same location as the OP with a SIGBUS:

dublin$ ./testit
Bus Error(coredump)
dublin$ dbx testit core
Reading testit
core file header read successfully
Reading ld.so.1
Reading libc.so.1
Reading libdl.so.1
Reading libc_psr.so.1
program terminated by signal BUS (object specific hardware error)
0xff2d4150: strcat+0x0020: ldsb [%o1], %o0
(dbx)

My recommendation to Franklin Li: Check out what was actually mapped at
the address 0x41dadfeb. This is the contents of %o1 which at that point
equals the second parameter of strcat. (As strcat is a leaf procedure
the input parameters are never shifted to %i0, %i1 etc).

Andreas.