Tracking down a segfault that suddenly started happening

Re:Tracking down a segfault that suddenly started happening by jagrsw on Monday January 18, 2021 @07:53AM (#25821288)

A possibly similar story:

I sometimes play video games on Steam under Linux. Recently I bought a new CPU (based on Zen3) and one of the games - Dirt Rally - started segfaulting.

After a quick fight with attaching strace to a running process under Steam (it was crashing v. quickly, so some racy script was needed), it turned out it crashes with

  SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_PKUERR, si_addr=0x7ff88440e7b8}

A quick session with kernel sources, revealed it's about Memory Protection Keys (this causes SEGV_PKUERR), which seemed like something that game was not using at all, because it's quite a new feature. After another hour or two, I found out what was the cause. The game was mmaping a PROT_EXEC memory segment without the PROT_READ flag, and was trying to read something from there with a 'mov' assembler instruction.

  mprotect(0x7ff884400000, 139264, PROT_EXEC) = 0

And under older i386/x86-64 CPUs it implicitly means PROT_EXEC|PROT_READ, because there is no way to make something executable, but readable. Under newer CPUs, the Linux kernel uses Memory Protection Keys to make the memory region actually executable-only.

After creating a quick'n'dirty LD_PRELOAD'able lib, the problem went away. Though, I wonder about Linus Torvald's mantra here, that the Linux kernel shouldn't break the userspace :)

  $  cat game.c
  #include <sys/mman.h>
  #include <unistd.h>
  #include <sys/syscall.h>
  
  int mprotect(void *addr, size_t len, int prot) {
   if (prot == PROT_EXEC) {
    prot |= PROT_READ;
   }
   return syscall(__NR_mprotect, addr, len, prot);
  }
  $ gcc game.c -shared -o game.so
  $ LD_PRELOAD=./game.so steam

[ Parent | on HN ]

Re:Tracking down a segfault that suddenly started happening by robertnn on Monday January 18, 2021 @08:26AM (#25821536)

I really enjoy stories like this. Thanks for sharing. Must have been really satisfying to get it working!

[ Parent | on HN ]

Re:Tracking down a segfault that suddenly started happening by jagrsw on Monday January 18, 2021 @08:36AM (#25821610)

Another one then :)

A few months ago I tried to run CSGO under Wayland. I recompiled libSDL.so b/c the one delivered with CSGO doesn't support Wayland, and ran with it LD_PRELOAD'ed. The game crashed upon start. After another debugging session with gdb/strace, I figured out that the CSGO binary is calling

  strstr()

with one of its arguments passed as a negative value from some other function, and it happens under Wayland only for some reason. Now, when preloading two libraries, and setting one environment flag I was able to play CSGO under Wayland.

  cat apps/strstr.c 
  #define _GNU_SOURCE
  #include <string.h>
  #include <dlfcn.h>
  #include <stdint.h>
  #include <inttypes.h>
  
  char *strstr(const char *haystack, const char *needle) {
   if ((uintptr_t)haystack > (uintptr_t)0xFFFFFFFF00000000) {
    return NULL;
   }
  
   char* (*p)(const char *haystack, const char *needle) = dlsym(RTLD_NEXT, "strstr");
   return p(haystack, needle);
  }
  
  $ SDL_VIDEODRIVER=wayland LD_PRELOAD=/home/<user>/apps/strstr.so:/home/<user>/Downloads/SDL-master/build/.libs/libSDL2-2.0.so.0.12.1 steam

But after playing with all those strace's/gdb's/LD_PRELOAD's my trust factor in CSGO (the score which says how likely I am to cheat in the near future), went down from Green (good player) to Red (Significantly Bad - will start cheating any moment:) within a week. And that's for 2012 account, with Prime enabled since 2016, and a couple of hundred matchmaking games played, and many more casual/FFA games. So YMMV :)

I wrote to [email protected] asking if they could verify if my account really deserves this rating, because every second CSGO match is again blatant cheaters now, but since nothing changed since a week (when I wrote it), this probably means that LD_PRELOAD'ing your steam is not a good idea :).

[ Parent | on HN ]

Re:Tracking down a segfault that suddenly started happening by finnthehuman on Monday January 18, 2021 @11:23AM (#25823293)

>but since nothing changed since a week (when I wrote it), this probably means that LD_PRELOAD'ing your steam is not a good idea :).

Welcome to the "knows too much to be trustworthy" category of perceived-troublemaker.

[ Parent | on HN ]

Re:Tracking down a segfault that suddenly started happening by feb on Monday January 18, 2021 @10:23AM (#25822605)

And this story gives an extra argument in favor of dynamic libraries as they make it easier to fix some bugs in compiled applications (except for games which check if someone messed with LD_PRELOAD).

[ Parent | on HN ]

Re:Tracking down a segfault that suddenly started happening by spuz on Monday January 18, 2021 @11:23AM (#25823289)

> because there is no way to make something executable, but readable.

Did you mean to say "there is no way to make something executable, but not readable" ?

[ Parent | on HN ]

Re:Tracking down a segfault that suddenly started happening by jagrsw on Monday January 18, 2021 @11:34AM (#25823417)

Yes

[ Parent | on HN ]