seg-fault in unexelf.c

[Chip Coldwell]

I have been having a problem building emacs on GNU/Linux (in
particular, the Fedora Core 5 distribution).  The build process runs
the following command in the src/ subdirectory:

./temacs -l loadup -batch dump

to cause the temacs binary (essentially emacs without the Lisp code
loaded) to set up the Lisp environment in the process address space
and then create a new ELF file with a new .data section that contains
the .data and .bss sections from the temacs process.

If I build the temacs binary with no compiler optimization (gcc (GCC)
4.1.0 20060304 (Red Hat 4.1.0-3)), the command above seg-faults in the
unexec function (file unexelf.c) while executing this line:

          memcpy (NEW_SECTION_H (nn).sh_offset + new_base,
                  (caddr_t) OLD_SECTION_H (n).sh_addr,
                  new_data2_size);

I unrolled the memcpy thus:

          p = NEW_SECTION_H (nn).sh_offset + new_base;
          q = (caddr_t) OLD_SECTION_H (n).sh_addr;
          for(i=0; i<new_data2_size; i++)
            p[i] = q[i];

ran the debugger and found the segfault happens when

(gdb) p/x q+i
$5 = 0x82f0000
(gdb) p/x i
$8 = 0xed160
(gdb) p/x new_bss_addr
$10 = 0x852a000

In the meantime, if I look in /proc/[PID]/maps I find this:

08048000-081fa000 r-xp 00000000 fd:00 1311728    
/home/coldwell/rpm/BUILD/emacs-21.4/src/temacs
081fa000-08203000 rw-p 001b2000 fd:00 1311728    
/home/coldwell/rpm/BUILD/emacs-21.4/src/temacs
08203000-082f0000 rw-p 08203000 00:00 0 
08337000-0852a000 rw-p 08337000 00:00 0          [heap]
b730e000-b7da3000 rw-p b730e000 00:00 0

The problem is that the Linux kernel has set up the process virtual
memory with a hole in it, and when the memcpy steps into this hole, it
seg-faults.

Here are more details.  "new_data2_size" is computed from (paraphrasing)

new_data2_size = sbrk(0) - OLD_SECTION_H (old_bss_index).sh_addr

In other words, the size of the new data section is determined to be
the top of the heap of the current temacs process minus the bottom of
the .bss in the temacs ELF file on disk.

"readelf -S temacs" gives

 [20] .data             PROGBITS        081fa880 1b2880 008610 00  WA  0   0 32
 [21] .bss              NOBITS          08202ea0 1bae90 0ec6d0 00  WA  0   0 32

Chip

--
Charles M. "Chip" Coldwell
Senior Software Engineer
Red Hat, Inc
978-392-2426