8000 A SIGSEGV error was encountered in the multithreaded concurrent scenario · Issue #1060 · frida/frida-gum · GitHub
[go: up one dir, main page]

Skip to content

A SIGSEGV error was encountered in the multithreaded concurrent scenario #1060

Open

Description

@byte0100

The SIGSEGV error is encountered probabilistically when the test program is repeatedly launched.The source code of the test program is as follows:
multi_thread_test.cpp
The compile options are as follows:
-std=c++11 -g -O0 -lpthread -ldl -lrt -lresolv -lm src/frida-gum/libfrida-gum.a
libfrida-gum.a is taken from https://github.com/frida/frida/releases/download/16.5.1/frida-gum-devkit-16.5.1-linux-x86_64.tar.xz
The gdb information is as follows:

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `./frida-multi-test'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000000000406827 in matrix_multiply (a=5, b=65535) at src/frida-gum/multi_thread_test.cpp:23
23      int matrix_multiply(int a, int b) {
[Current thread is 1 (Thread 0x7fd7df22a700 (LWP 434103))]
(gdb) bt
#0  0x0000000000406827 in matrix_multiply (a=5, b=65535) at src/frida-gum/multi_thread_test.cpp:23
#1  0x00000000004068ab in thread_func (arg=0x7ffd48c64470) at src/frida-gum/multi_thread_test.cpp:35
#2  0x00007fd7e24cc6ca in start_thread () from /lib64/libpthread.so.0
#3  0x00007fd7e1336edf in clone () from /lib64/libc.so.6
(gdb) disassemble /r
Dump of assembler code for function matrix_multiply(int, int):
   0x0000000000406826 <+0>:     e9 dd 07 6b 00  jmpq   0xab7008
   0x000000000040682b <+5>:     66 90   xchg   %ax,%ax
   0x000000000040682d <+7>:     89 75 f8        mov    %esi,-0x8(%rbp)
   0x0000000000406830 <+10>:    8b 55 fc        mov    -0x4(%rbp),%edx
   0x0000000000406833 <+13>:    8b 45 f8        mov    -0x8(%rbp),%eax
   0x0000000000406836 <+16>:    01 d0   add    %edx,%eax
   0x0000000000406838 <+18>:    5d      pop    %rbp
   0x0000000000406839 <+19>:    c3      retq   
End of assembler dump.
(gdb) info reg
rax            0x1                 1
rbx            0x0                 0
rcx            0x7ffffff7          2147483639
rdx            0x2                 2
rsi            0x2                 2
rdi            0x1                 1
rbp            0x7fd7df229f10      0x7fd7df229f10
rsp            0x7fd7df229ed0      0x7fd7df229ed0
r8             0x1                 1
r9             0x12                18
r10            0x64                100
r11            0x0                 0
r12            0x0                 0
r13            0x7ffd48c643df      140725824406495
r14            0x7fd7df22a9c0      140565138287040
r15            0x7fd7df22a700      140565138286336
rip            0x406827            0x406827 <matrix_multiply(int, int)+1>
eflags         0x10202             [ IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0
k0             0x0                 0
k1             0x0                 0
k2             0x0                 0
k3             0x0                 0
k4             0x0                 0
k5             0x0                 0
k6             0x0                 0
k7             0x0                 0
(gdb) quit

Activity

  1. byte0100 commented on Aug 19, 2025

    @byte0100
    Author

    This error can also be reproduced in the latest version 17.2.16.

    libfrida-gum.a is taken from https://github.com/frida/frida/releases/download/17.2.16/frida-core-devkit-17.2.16-linux-x86_64.tar.xz

    The source code of the test program which adapt to version 17.2.16 is as follows:
    multi_thread_test.cpp

    The gdb information is as follows:

    • The segmentation fault (SIGSEGV) happened when the instruction pointer (RIP) pointed to a jmpq instruction that was modified by Frida-Gum during runtime.
    • The target address of the jmpq instruction does not map to a valid location within the process.
    Core was generated by `./frida-multi-test'.
    Program terminated with signal SIGSEGV, Segmentation fault.
    #0  0x0000000000406917 in matrix_multiply (a=5, b=65535) at src/frida-gum/multi_thread_test.cpp:22
    22      int matrix_multiply(int a, int b) {
    [Current thread is 1 (Thread 0x7febe6f0a700 (LWP 219824))]
    (gdb) bt
    #0  0x0000000000406917 in matrix_multiply (a=5, b=65535) at src/frida-gum/multi_thread_test.cpp:22
    #1  0x000000000040699b in thread_func (arg=0x7ffd41f12550) at src/frida-gum/multi_thread_test.cpp:34
    #2  0x00007febe81a86ca in start_thread () from /lib64/libpthread.so.0
    #3  0x00007febe7012edf in clone () from /lib64/libc.so.6
    (gdb) disassemble /r
    Dump of assembler code for function matrix_multiply(int, int):
       0x0000000000406916 <+0>:     e9 ed 16 6c 00  jmpq   0xac8008
       0x000000000040691b <+5>:     66 90   xchg   %ax,%ax
       0x000000000040691d <+7>:     89 75 f8        mov    %esi,-0x8(%rbp)
       0x0000000000406920 <+10>:    8b 55 fc        mov    -0x4(%rbp),%edx
       0x0000000000406923 <+13>:    8b 45 f8        mov    -0x8(%rbp),%eax
       0x0000000000406926 <+16>:    01 d0   add    %edx,%eax
       0x0000000000406928 <+18>:    5d      pop    %rbp
       0x0000000000406929 <+19>:    c3      retq   
    End of assembler dump.
    (gdb) info proc mappings 
    Mapped address spaces:
    
              Start Addr           End Addr       Size     Offset objfile
                0x400000           0x406000     0x6000        0x0    /path/to/frida-multi-test
                0x406000           0x407000     0x1000     0x6000 /path/to/frida-multi-test
                0x407000           0xac7000   0x6c0000     0x7000 /path/to/frida-multi-test
                0xcc7000           0xe0e000   0x147000   0x6c7000 /path/to/frida-multi-test
                0xe0e000           0xe11000     0x3000   0x80e000 /path/to/frida-multi-test
          0x7febdbab0000     0x7febdcf07000  0x1457000        0x0 /path/to/frida-multi-test
    
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      0