at_exit_handler failed to work when dso_handle is NULL

[xiangzhai]

Hi,

Testcase failed to handle atexit to be called at normal process termination: debug.log

Reduced Testcase:

#include <stdio.h>
#include <stdlib.h>
void cleanup1(void) {
    printf("cleanup1 \n");
}
int main(void) {
    printf("main in \n");
    atexit(cleanup1);
    return 0;
}

Actual:

main in

Expected:

main in 
cleanup1

debug patch:

diff --git a/src/tools/cleanup.c b/src/tools/cleanup.c
index 79ac34518..cf0518ccb 100644
--- a/src/tools/cleanup.c
+++ b/src/tools/cleanup.c
@@ -28,8 +28,11 @@ void AddCleanup(x64emu_t *emu, void *p)
 void AddCleanup1Arg(x64emu_t *emu, void *p, void* a, elfheader_t* h)
 {
     (void)emu;
-    if(!h)
+    if (!h) {
+        printf_log(LOG_DEBUG, "%s:%d p=%p a=%p\n", __func__, __LINE__, p, a);
+        AddCleanup(emu, p);
         return;
+    }
 
     if(h->clean_sz == h->clean_cap) {
         h->clean_cap += 32;

debug.log

Thanks,
Leslie Zhai

[ksco]

sh-5.2$ box64 ./atexit 2>/dev/null 
main in 
cleanup1 
sh-5.2$ file ./atexit 
./atexit: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=3a0a9fe809e6d134270a21e948a58f1fa051d3b0, for GNU/Linux 3.2.0, not stripped
sh-5.2$ 

I cannot reproduce.

[xiangzhai]

Hi,

The root cause is dso_handle is NULL for a very old x86_64 machine v3.10.0 kernel:

14530|0x40116f: Calling __cxa_atexit(./test_cleanup-x86_64)(0x401146, 0x0, 0x0, ...)
 =>[BOX64] DEBUG: my___cxa_atexit:547 dso_handle=(nil)

Built on the very old x86_64 machine atexit_dso_handle_null.zip and objdump to test_cleanup-x86_64.S:

0000000000401200 <atexit>:
  401200:       48 8d 05 01 0e 00 00    lea    0xe01(%rip),%rax        # 402008 <__dso_handle>
  401207:       48 85 c0                test   %rax,%rax
  40120a:       74 0a                   je     401216 <atexit+0x16>
=>  40120c:       48 8b 10                mov    (%rax),%rdx
  40120f:       31 f6                   xor    %esi,%esi
  401211:       e9 4a fe ff ff          jmp    401060 <__cxa_atexit@plt>
  401216:       31 d2                   xor    %edx,%edx
  401218:       eb f5                   jmp    40120f <atexit+0xf>

xRDX (mapped to $r6) is 0x0:

[BOX64] New Instruction x64:0x40120c, native:0xfff6fad338
[BOX64] 0x40120c: 48 8B 10  MOV Gd, Ed
[BOX64] 0xfff6fad338: 2 emitted opcodes, inst=3, barrier=0 state=0/none_pending(none_pending->none_pending), set=0/0, use=0, need=0/0, fuse=0/1, sm=0(0/0), pred=2, last_ip=0x401200
        28c00186        LD.D            xRDX, xRAX, 0 
        002a0005        05002A00 ???
...
   0xfff6fad328:        lu12i.w $r12,1026(0x402)
   0xfff6fad32c:        ori     $r12,$r12,0x8
   0xfff6fad330:        beq     $r12,$r0,60(0x3c) # 0xfff6fad36c
   0xfff6fad334:        andi    $r0,$r0,0x0
=>   0xfff6fad338:        ld.d    $r6,$r12,0
   0xfff6fad33c:        break   0x5
   0xfff6fad340:        ori     $r17,$r0,0x36
   0xfff6fad344:        st.w    $r17,$r31,1100(0x44c)
   0xfff6fad348:        xor     $r5,$r5,$r5
   0xfff6fad34c:        st.w    $r5,$r31,1120(0x460)
...
(gdb) i r $r6
r6             0x0                 0

And it is not reproduced if dso_handle is not NULL built on a new x86_64 machine Ubuntu 22.04.5 LTS:

14686|0x1000011a9: Calling __cxa_atexit(./test_cleanup-x86-64)(0x100001169, 0x0, 0x100004008, ...) 
=>[BOX64] DEBUG: my___cxa_atexit:547 dso_handle=0x100004008

I am investigating why latx is still able to work even dso_handle is NULL.

Thanks,
Leslie Zhai

[xiangzhai]

Hi,

Testcase failed to handle atexit to be called at normal process termination: debug.log

Sorry I forgot to test atexit in the shared library failed to be called: test_atexit.zip

Thanks,
Leslie Zhai