Created attachment 272281 [details] top core Running FreeBSD 15.1-RELEASE on a Raspberry Pi Zero 2 W (installed from the official image), several base programs like top, pkg, cron, zsh, tzsetup, ... core dump frequently: root@dns2:~ # grep core /var/log/messages Jun 12 12:55:48 generic kernel: pid 113 (growfs), jid 0, uid 0: exited on signal 11 (no core dump - other error) Jun 22 13:42:24 dns2 kernel: pid 3338 (zsh), jid 0, uid 0: exited on signal 11 (core dumped) Jun 22 13:42:33 dns2 kernel: pid 3357 (zsh), jid 0, uid 0: exited on signal 11 (core dumped) Jun 22 13:49:31 dns2 kernel: pid 2665 (ntpd), jid 0, uid 233: exited on signal 11 (no core dump - sugid process denied by kern.sugid_coredump) Jun 22 13:51:12 dns2 kernel: pid 2025 (zsh), jid 0, uid 1002: exited on signal 11 (core dumped) Jun 22 14:08:48 dns2 kernel: pid 1762 (ntpd), jid 0, uid 233: exited on signal 11 (no core dump - sugid process denied by kern.sugid_coredump) Jun 23 03:29:29 dns2 kernel: pid 3898 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) Jun 23 12:21:04 dns2 kernel: pid 4790 (tzsetup), jid 0, uid 1002: exited on signal 11 (core dumped) Jun 23 16:14:39 dns2 kernel: pid 5139 (top), jid 0, uid 0: exited on signal 11 (core dumped) Jun 23 23:55:00 dns2 kernel: pid 5771 (cron), jid 0, uid 0: exited on signal 11 (no core dump - sugid process denied by kern.sugid_coredump) Jun 24 03:45:14 dns2 kernel: pid 6521 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) Jun 25 03:01:17 dns2 kernel: pid 9504 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) Jun 25 12:30:42 dns2 kernel: pid 10419 (top), jid 0, uid 1002: exited on signal 11 (core dumped) Jun 25 17:44:00 dns2 kernel: pid 11373 (cron), jid 0, uid 0: exited on signal 11 (no core dump - sugid process denied by kern.sugid_coredump) Jun 25 19:30:11 dns2 kernel: pid 11518 (top), jid 0, uid 0: exited on signal 11 (core dumped) Jun 26 03:27:25 dns2 kernel: pid 12611 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) Jun 27 03:34:13 dns2 kernel: pid 15110 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) Jun 27 07:55:00 dns2 kernel: pid 15768 (cron), jid 0, uid 0: exited on signal 11 (no core dump - sugid process denied by kern.sugid_coredump) Jun 28 03:01:16 dns2 kernel: pid 17755 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) Jun 29 03:06:44 dns2 kernel: pid 20276 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) Jun 29 15:15:00 dns2 kernel: pid 21403 (cron), jid 0, uid 0: exited on signal 11 (no core dump - sugid process denied by kern.sugid_coredump) Jun 30 03:01:23 dns2 kernel: pid 22794 (pkg), jid 0, uid 0: exited on signal 11 (core dumped) root@dns2:~ # I'm attaching a core from top, I can provide other cores if necessary. Backtrace of the core shows: root@dns2:~ # gdb top top.core GNU gdb (GDB) 15.1 [GDB v15.1 for FreeBSD] Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "aarch64-portbld-freebsd15.0". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from top... Reading symbols from /usr/lib/debug//usr/bin/top.debug... [New LWP 100121] Core was generated by `top -a'. Program terminated with signal SIGSEGV, Segmentation fault. Invalid permissions for mapped object. #0 0x00000e018873c004 in __get_locale () at /usr/src/lib/libc/stdio/vsprintf.c:52 warning: 52 /usr/src/lib/libc/stdio/vsprintf.c: No such file or directory (gdb) bt full #0 0x00000e018873c004 in __get_locale () at /usr/src/lib/libc/stdio/vsprintf.c:52 No locals. #1 vsprintf (str=0xe01853ae538 "select", fmt=0xe0104643a89 "%.6s", ap=...) at /usr/src/lib/libc/stdio/vsprintf.c:67 No locals. #2 0x00000e0188731090 in sprintf (str=0xe01853ae538 "select", fmt=0xe0104643a89 "%.6s") at /usr/src/lib/libc/stdio/sprintf.c:55 ap = {__stack = 0xe01853ae480, __gr_top = 0xe01853ae410, __vr_top = 0xe01853ae3e0, __gr_offs = -48, __vr_offs = -128} ret = <optimized out> #3 0x00000e010465ba04 in format_next_process (xhandle=<optimized out>, xhandle@entry=0xe0104681fc0 <handle>, get_userid=get_userid@entry=0xe010465fa80 <username>, flags=1) at /usr/src/usr.bin/top/machine.c:1115 procbuf = 0xeb137040190 status = "select\000\000\3501\201\210\001\016\000\000ױ\n7\261\016" cmdbuf = 0x0 ru = {ru_utime = {tv_sec = 0, tv_usec = 0}, ru_stime = {tv_sec = 0, tv_usec = 0}, ru_maxrss = 0, ru_ixrss = 0, ru_idrss = 0, ru_isrss = 0, ru_minflt = 0, ru_majflt = 0, ru_nswap = 0, ru_inblock = 0, ru_oublock = 0, ru_msgsnd = 0, ru_msgrcv = 0, ru_nsignals = 0, ru_nvcsw = -902229251797279410, ru_nivcsw = 15399692985712} pp = 0xeb1370bc240 state = <optimized out> cputime = <optimized out> args = <optimized out> oldp = <optimized out> rup = <optimized out> p_tot = <optimized out> s_tot = <optimized out> #4 0x00000e010465e57c in main (argc=1, argv=0xe010465fa80 <username>) at /usr/src/usr.bin/top/top.c:660 tempbuf1 = '\000' <repeats 49 times> tempbuf2 = '\000' <repeats 49 times> system_info = {last_pid = 11520, load_avg = {0, 0, 0}, p_total = 29, p_pactive = 29, procstates = 0xe0104681f80 <process_states>, cpustates = 0xe0104681e34 <cpu_states>, memory = 0xe0104681ec0 <memory_stats>, arc = 0x0, carc = 0x0, swap = 0xe0104681edc <swap_stats>, boottime = {tv_sec = 1782145905, tv_usec = 604981}, battery = 0, ncpus = 1} statics = {procstate_names = 0xe0104681538 <procstatenames>, cpustate_names = 0xe0104681580 <cpustatenames>, memory_names = 0xe01046815b0 <memorynames>, arc_names = 0x0, carc_names = 0x0, swap_names = 0xe0104681640 <swapnames>, order_names = 0x0, nbatteries = 0, ncpus = 4} old_sigmask = {__bits = {0, 0, 0, 0}} new_sigmask = {__bits = {131078, 0, 0, 0}} curr_time = 1782415811 preset_argc = 0 ch = 96 '`' --Type <RET> for more, q to quit, c to continue without paging-- readfds = {__fds_bits = {0 <repeats 16 times>}} nptr = 0x0 sel_ret = <optimized out> displays = -1 delay = {tv_sec = 2, tv_usec = 0} topn = 2147483647 timeout = <optimized out> sort_info = 0xe0104670ca8 <sortdata> order_name = 0xeb137008000 " PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND" no_command = <optimized out> topn_specified = 0 '\000' warnings = <optimized out> interactive = <optimized out> do_unames = <optimized out> ac = <optimized out> av = <optimized out> uname_field = 0xe010464469e "USERNAME" get_userid = 0xe010465fa80 <username> env_top = <optimized out> preset_argv = <optimized out> i = 12 header_text = 0xeb137008000 " PID USERNAME THR PRI NICE SIZE RES STATE C TIME WCPU COMMAND" processes = 0xe0104681fc0 <handle> active_procs = 29 restart = <optimized out> (gdb) (gdb) quit root@dns2:~ #
Can you use the "disassemble" command to give me some assembly to look at?
Of course, here you go: root@dns2:~ # gdb top top.core GNU gdb (GDB) 15.1 [GDB v15.1 for FreeBSD] Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "aarch64-portbld-freebsd15.0". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from top... Reading symbols from /usr/lib/debug//usr/bin/top.debug... [New LWP 100121] Core was generated by `top -a'. Program terminated with signal SIGSEGV, Segmentation fault. Invalid permissions for mapped object. #0 0x00000e018873c004 in __get_locale () at /usr/src/lib/libc/stdio/vsprintf.c:52 warning: 52 /usr/src/lib/libc/stdio/vsprintf.c: No such file or directory (gdb) disassemble Dump of assembler code for function vsprintf: 0x00000e018873bf60 <+0>: sub sp, sp, #0x1b0 0x00000e018873bf64 <+4>: stp x29, x30, [sp, #384] 0x00000e018873bf68 <+8>: stp x28, x21, [sp, #400] 0x00000e018873bf6c <+12>: stp x20, x19, [sp, #416] 0x00000e018873bf70 <+16>: add x29, sp, #0x180 0x00000e018873bf74 <+20>: adrp x8, 0xe0188800000 0x00000e018873bf78 <+24>: movi v0.2d, #0x0 0x00000e018873bf7c <+28>: adrp x10, 0xe0188800000 0x00000e018873bf80 <+32>: ldr x8, [x8, #200] 0x00000e018873bf84 <+36>: mov x19, x1 0x00000e018873bf88 <+40>: mov x20, x0 0x00000e018873bf8c <+44>: ldr x8, [x8] 0x00000e018873bf90 <+48>: stur x8, [x29, #-8] 0x00000e018873bf94 <+52>: add x8, sp, #0x40 0x00000e018873bf98 <+56>: ldp q1, q2, [x2] 0x00000e018873bf9c <+60>: add x9, x8, #0x8 0x00000e018873bfa0 <+64>: stp q0, q0, [x9, #272] 0x00000e018873bfa4 <+68>: str q0, [x9, #256] 0x00000e018873bfa8 <+72>: adrp x9, 0xe0188800000 0x00000e018873bfac <+76>: stp q1, q2, [sp] 0x00000e018873bfb0 <+80>: stur q0, [x8, #248] 0x00000e018873bfb4 <+84>: stur q0, [x8, #232] 0x00000e018873bfb8 <+88>: stur q0, [x8, #216] 0x00000e018873bfbc <+92>: stur q0, [x8, #200] 0x00000e018873bfc0 <+96>: stur q0, [x8, #184] 0x00000e018873bfc4 <+100>: stur q0, [x8, #168] 0x00000e018873bfc8 <+104>: stur q0, [x8, #152] 0x00000e018873bfcc <+108>: stur q0, [x8, #136] 0x00000e018873bfd0 <+112>: ldr x9, [x9, #536] 0x00000e018873bfd4 <+116>: stur q0, [x8, #120] 0x00000e018873bfd8 <+120>: ldr x10, [x10, #528] 0x00000e018873bfdc <+124>: stur q0, [x8, #104] 0x00000e018873bfe0 <+128>: mrs x11, tpidr_el0 0x00000e018873bfe4 <+132>: stur q0, [x8, #88] 0x00000e018873bfe8 <+136>: ldr x10, [x11, x10] 0x00000e018873bfec <+140>: stur q0, [x8, #72] --Type <RET> for more, q to quit, c to continue without paging--c 0x00000e018873bff0 <+144>: ldr w8, [x9] 0x00000e018873bff4 <+148>: stur q0, [sp, #120] 0x00000e018873bff8 <+152>: adrp x9, 0xe0188800000 0x00000e018873bffc <+156>: stur q0, [sp, #104] 0x00000e018873c000 <+160>: cmp x10, #0x0 => 0x00000e018873c004 <+164>: ldr x9, [x9, #544] 0x00000e018873c008 <+168>: ccmp w8, #0x0, #0x4, ne // ne = any 0x00000e018873c00c <+172>: mov w8, #0xffff // #65535 0x00000e018873c010 <+176>: stur q0, [sp, #88] 0x00000e018873c014 <+180>: stur q0, [sp, #72] 0x00000e018873c018 <+184>: csel x21, x9, x10, eq // eq = none 0x00000e018873c01c <+188>: strh w8, [sp, #82] 0x00000e018873c020 <+192>: bl 0xe01887e3320 <__error@plt> 0x00000e018873c024 <+196>: ldr w2, [x0] 0x00000e018873c028 <+200>: cbz x21, 0xe018873c040 <vsprintf+224> 0x00000e018873c02c <+204>: cmn x21, #0x1 0x00000e018873c030 <+208>: b.ne 0xe018873c048 <vsprintf+232> // b.any 0x00000e018873c034 <+212>: adrp x21, 0xe0188800000 0x00000e018873c038 <+216>: ldr x21, [x21, #544] 0x00000e018873c03c <+220>: b 0xe018873c048 <vsprintf+232> 0x00000e018873c040 <+224>: adrp x21, 0xe0188800000 0x00000e018873c044 <+228>: ldr x21, [x21, #656] 0x00000e018873c048 <+232>: ldp q0, q1, [sp] 0x00000e018873c04c <+236>: mov w8, #0x208 // #520 0x00000e018873c050 <+240>: strh w8, [sp, #80] 0x00000e018873c054 <+244>: mov w8, #0x7fffffff // #2147483647 0x00000e018873c058 <+248>: add x0, sp, #0x40 0x00000e018873c05c <+252>: add x4, sp, #0x20 0x00000e018873c060 <+256>: mov x1, x21 0x00000e018873c064 <+260>: mov x3, x19 0x00000e018873c068 <+264>: str x20, [sp, #64] 0x00000e018873c06c <+268>: str x20, [sp, #88] 0x00000e018873c070 <+272>: str w8, [sp, #76] 0x00000e018873c074 <+276>: str w8, [sp, #96] 0x00000e018873c078 <+280>: stp q0, q1, [sp, #32] 0x00000e018873c07c <+284>: bl 0xe01887325e4 <__vfprintf> 0x00000e018873c080 <+288>: ldr x8, [sp, #64] 0x00000e018873c084 <+292>: strb wzr, [x8] 0x00000e018873c088 <+296>: adrp x8, 0xe0188800000 0x00000e018873c08c <+300>: ldr x8, [x8, #200] 0x00000e018873c090 <+304>: ldur x9, [x29, #-8] 0x00000e018873c094 <+308>: ldr x8, [x8] 0x00000e018873c098 <+312>: cmp x8, x9 0x00000e018873c09c <+316>: b.ne 0xe018873c0b4 <vsprintf+340> // b.any 0x00000e018873c0a0 <+320>: ldp x20, x19, [sp, #416] 0x00000e018873c0a4 <+324>: ldp x28, x21, [sp, #400] 0x00000e018873c0a8 <+328>: ldp x29, x30, [sp, #384] 0x00000e018873c0ac <+332>: add sp, sp, #0x1b0 0x00000e018873c0b0 <+336>: ret 0x00000e018873c0b4 <+340>: bl 0xe01887e32f0 <__stack_chk_fail@plt> End of assembler dump. (gdb) I think I ran into the same issue as already reported here: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296240
(In reply to Andreas Schuh from comment #2) Thank you for the debugging details. Let's see if we can get this one solved. > I think I ran into the same issue as already reported here: > https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296240 Looks likely! I've added that one as a related bug.
Could you try the last one produced from PR296240 (the one with sprintf in the cycle)? If it fails, please provide the requested GDB output, mainly the fault address from the live GDB session, the registers, and the process memory mapping. In addition, could you provide the output from "truss -d ./test_program"? One last thing, are you able to reproduce this on the recent current?
Here you go: andy@dns2:~ $ cc -o test test.c andy@dns2:~ $ gdb ./test GNU gdb (GDB) 15.1 [GDB v15.1 for FreeBSD] Copyright (C) 2024 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "aarch64-portbld-freebsd15.0". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from ./test... (gdb) run Starting program: /home/andy/test Program received signal SIGSEGV, Segmentation fault. Invalid permissions for mapped object. vsprintf (str=0x230730 <buf> "bc614e", fmt=0x200490 "%x", ap=...) at /usr/src/lib/libc/stdio/vsprintf.c:67 warning: 67 /usr/src/lib/libc/stdio/vsprintf.c: No such file or directory (gdb) bt full #0 vsprintf (str=0x230730 <buf> "bc614e", fmt=0x200490 "%x", ap=...) at /usr/src/lib/libc/stdio/vsprintf.c:67 No locals. #1 0x0000000040531090 in sprintf (str=0x230730 <buf> "bc614e", fmt=0x200490 "%x") at /usr/src/lib/libc/stdio/sprintf.c:55 ap = {__stack = 0xffffffffea10, __gr_top = 0xffffffffe9a0, __vr_top = 0xffffffffe970, __gr_offs = -48, __vr_offs = -128} ret = <optimized out> #2 0x000000000021055c in main () No symbol table info available. (gdb) disassemble Dump of assembler code for function vsprintf: 0x000000004053bf60 <+0>: sub sp, sp, #0x1b0 0x000000004053bf64 <+4>: stp x29, x30, [sp, #384] 0x000000004053bf68 <+8>: stp x28, x21, [sp, #400] 0x000000004053bf6c <+12>: stp x20, x19, [sp, #416] 0x000000004053bf70 <+16>: add x29, sp, #0x180 0x000000004053bf74 <+20>: adrp x8, 0x40600000 0x000000004053bf78 <+24>: movi v0.2d, #0x0 0x000000004053bf7c <+28>: adrp x10, 0x40600000 0x000000004053bf80 <+32>: ldr x8, [x8, #200] 0x000000004053bf84 <+36>: mov x19, x1 0x000000004053bf88 <+40>: mov x20, x0 0x000000004053bf8c <+44>: ldr x8, [x8] 0x000000004053bf90 <+48>: stur x8, [x29, #-8] 0x000000004053bf94 <+52>: add x8, sp, #0x40 0x000000004053bf98 <+56>: ldp q1, q2, [x2] 0x000000004053bf9c <+60>: add x9, x8, #0x8 0x000000004053bfa0 <+64>: stp q0, q0, [x9, #272] 0x000000004053bfa4 <+68>: str q0, [x9, #256] 0x000000004053bfa8 <+72>: adrp x9, 0x40600000 0x000000004053bfac <+76>: stp q1, q2, [sp] 0x000000004053bfb0 <+80>: stur q0, [x8, #248] 0x000000004053bfb4 <+84>: stur q0, [x8, #232] 0x000000004053bfb8 <+88>: stur q0, [x8, #216] 0x000000004053bfbc <+92>: stur q0, [x8, #200] 0x000000004053bfc0 <+96>: stur q0, [x8, #184] 0x000000004053bfc4 <+100>: stur q0, [x8, #168] 0x000000004053bfc8 <+104>: stur q0, [x8, #152] 0x000000004053bfcc <+108>: stur q0, [x8, #136] 0x000000004053bfd0 <+112>: ldr x9, [x9, #536] 0x000000004053bfd4 <+116>: stur q0, [x8, #120] 0x000000004053bfd8 <+120>: ldr x10, [x10, #528] 0x000000004053bfdc <+124>: stur q0, [x8, #104] 0x000000004053bfe0 <+128>: mrs x11, tpidr_el0 0x000000004053bfe4 <+132>: stur q0, [x8, #88] 0x000000004053bfe8 <+136>: ldr x10, [x11, x10] 0x000000004053bfec <+140>: stur q0, [x8, #72] --Type <RET> for more, q to quit, c to continue without paging--c 0x000000004053bff0 <+144>: ldr w8, [x9] 0x000000004053bff4 <+148>: stur q0, [sp, #120] 0x000000004053bff8 <+152>: adrp x9, 0x40600000 0x000000004053bffc <+156>: stur q0, [sp, #104] 0x000000004053c000 <+160>: cmp x10, #0x0 => 0x000000004053c004 <+164>: ldr x9, [x9, #544] 0x000000004053c008 <+168>: ccmp w8, #0x0, #0x4, ne // ne = any 0x000000004053c00c <+172>: mov w8, #0xffff // #65535 0x000000004053c010 <+176>: stur q0, [sp, #88] 0x000000004053c014 <+180>: stur q0, [sp, #72] 0x000000004053c018 <+184>: csel x21, x9, x10, eq // eq = none 0x000000004053c01c <+188>: strh w8, [sp, #82] 0x000000004053c020 <+192>: bl 0x405e3320 <__error@plt> 0x000000004053c024 <+196>: ldr w2, [x0] 0x000000004053c028 <+200>: cbz x21, 0x4053c040 <vsprintf+224> 0x000000004053c02c <+204>: cmn x21, #0x1 0x000000004053c030 <+208>: b.ne 0x4053c048 <vsprintf+232> // b.any 0x000000004053c034 <+212>: adrp x21, 0x40600000 0x000000004053c038 <+216>: ldr x21, [x21, #544] 0x000000004053c03c <+220>: b 0x4053c048 <vsprintf+232> 0x000000004053c040 <+224>: adrp x21, 0x40600000 0x000000004053c044 <+228>: ldr x21, [x21, #656] 0x000000004053c048 <+232>: ldp q0, q1, [sp] 0x000000004053c04c <+236>: mov w8, #0x208 // #520 0x000000004053c050 <+240>: strh w8, [sp, #80] 0x000000004053c054 <+244>: mov w8, #0x7fffffff // #2147483647 0x000000004053c058 <+248>: add x0, sp, #0x40 0x000000004053c05c <+252>: add x4, sp, #0x20 0x000000004053c060 <+256>: mov x1, x21 0x000000004053c064 <+260>: mov x3, x19 0x000000004053c068 <+264>: str x20, [sp, #64] 0x000000004053c06c <+268>: str x20, [sp, #88] 0x000000004053c070 <+272>: str w8, [sp, #76] 0x000000004053c074 <+276>: str w8, [sp, #96] 0x000000004053c078 <+280>: stp q0, q1, [sp, #32] 0x000000004053c07c <+284>: bl 0x405325e4 <__vfprintf> 0x000000004053c080 <+288>: ldr x8, [sp, #64] 0x000000004053c084 <+292>: strb wzr, [x8] 0x000000004053c088 <+296>: adrp x8, 0x40600000 0x000000004053c08c <+300>: ldr x8, [x8, #200] 0x000000004053c090 <+304>: ldur x9, [x29, #-8] 0x000000004053c094 <+308>: ldr x8, [x8] 0x000000004053c098 <+312>: cmp x8, x9 0x000000004053c09c <+316>: b.ne 0x4053c0b4 <vsprintf+340> // b.any 0x000000004053c0a0 <+320>: ldp x20, x19, [sp, #416] 0x000000004053c0a4 <+324>: ldp x28, x21, [sp, #400] 0x000000004053c0a8 <+328>: ldp x29, x30, [sp, #384] 0x000000004053c0ac <+332>: add sp, sp, #0x1b0 0x000000004053c0b0 <+336>: ret 0x000000004053c0b4 <+340>: bl 0x405e32f0 <__stack_chk_fail@plt> End of assembler dump. (gdb) info registers x0 0x230730 2295600 x1 0x200490 2098320 x2 0xffffffffe9a0 281474976704928 x3 0x0 0 x4 0xffffffffde20 281474976701984 x5 0x230736 2295606 x6 0x31366362 825647970 x7 0xffffffffd2a0 281474976699040 x8 0x0 0 x9 0x40600000 1080033280 x10 0x0 0 x11 0x402e8010 1076789264 x12 0x6 6 x13 0x0 0 x14 0x10 16 x15 0x0 0 x16 0x40616610 1080124944 x17 0x4053bf60 1079230304 x18 0xe5 229 x19 0x200490 2098320 x20 0x230730 2295600 x21 0xffffffffeaa0 281474976705184 x22 0x1 1 x23 0x0 0 x24 0x0 0 x25 0x0 0 x26 0x0 0 x27 0x0 0 x28 0x0 0 x29 0xffffffffe8c0 281474976704704 x30 0x40531090 1079185552 sp 0xffffffffe740 0xffffffffe740 pc 0x4053c004 0x4053c004 <vsprintf+164> cpsr 0x60000200 [ EL=0 D BTYPE=0 C Z ] fpsr 0x0 [ ] fpcr 0x0 [ Len=0 Stride=0 RMode=0 ] tpidr 0x402e8010 0x402e8010 (gdb) info proc mappings process 2892 Mapped address spaces: Start Addr End Addr Size Offset Flags File 0x200000 0x201000 0x1000 0x0 r-- CN-- /home/andy/test 0x210000 0x211000 0x1000 0x0 r-x CN-- /home/andy/test 0x220000 0x221000 0x1000 0x0 r-- ---- 0x230000 0x231000 0x1000 0x0 rw- ---- 0x40230000 0x40236000 0x6000 0x0 r-- CN-- /libexec/ld-elf.so.1 0x40245000 0x4025c000 0x17000 0x5000 r-x C--- /libexec/ld-elf.so.1 0x4026b000 0x4026c000 0x1000 0x0 r-- ---- 0x4027b000 0x4027c000 0x1000 0x1b000 rw- C--- /libexec/ld-elf.so.1 0x4027c000 0x4029c000 0x20000 0x0 rw- ---- 0x402a0000 0x402b4000 0x14000 0x0 r-- CN-- /lib/libsys.so.7 0x402b4000 0x402c3000 0xf000 0x14000 --- CN-- 0x402c3000 0x402c8000 0x5000 0x13000 r-x CN-- /lib/libsys.so.7 0x402c8000 0x402d7000 0xf000 0x28000 --- CN-- 0x402d7000 0x402d8000 0x1000 0x17000 r-- C--- /lib/libsys.so.7 0x402d8000 0x402e7000 0xf000 0x38000 --- CN-- 0x402e7000 0x402e8000 0x1000 0x17000 rw- C--- /lib/libsys.so.7 0x402e8000 0x4030c000 0x24000 0x0 rw- ---- 0x40400000 0x40493000 0x93000 0x0 r-- CN-- /lib/libc.so.7 0x40493000 0x404a2000 0xf000 0x93000 --- CN-- 0x404a2000 0x405e7000 0x145000 0x92000 r-x CN-- /lib/libc.so.7 0x405e7000 0x405f6000 0xf000 0x1e7000 --- CN-- 0x405f6000 0x40601000 0xb000 0x1d6000 r-- C--- /lib/libc.so.7 0x40601000 0x40610000 0xf000 0x201000 --- CN-- 0x40610000 0x40617000 0x7000 0x1e0000 rw- C--- /lib/libc.so.7 0x40617000 0x40833000 0x21c000 0x0 rw- ---- 0x40a00000 0x41200000 0x800000 0x0 rw- ---- 0xffffbffff000 0xfffffffdf000 0x3ffe0000 0x70003 --- ---- 0xfffffffdf000 0xfffffffff000 0x20000 0x0 rw- ---D 0xfffffffff000 0x1000000000000 0x1000 0x0 r-x ---- (gdb) quit A debugging session is active. Inferior 1 [process 2892] will be killed. Quit anyway? (y or n) y andy@dns2:~ $ andy@dns2:~ $ andy@dns2:~ $ truss -d ./test 0.000625208 mmap(0x0,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 31236129030144 (0x1c68ba600000) 0.000994167 mprotect(0x4db96bdcb000,4096,PROT_READ) = 0 (0x0) 0.001180937 issetugid() = 0 (0x0) 0.001462135 sigfastblock(0x1,0x4db96bddcb78) = 0 (0x0) 0.001826041 open("/etc/libmap.conf",O_RDONLY|O_CLOEXEC,01) = 3 (0x3) 0.002008229 fstat(3,{ mode=-rw-r--r-- ,inode=403472,size=35,blksize=32768 }) = 0 (0x0) 0.002313280 read(3,"includedir /usr/local/etc/libmap"...,35) = 35 (0x23) 0.002686562 close(3) = 0 (0x0) 0.002968436 open("/usr/local/etc/libmap.d",O_RDONLY|O_DIRECTORY|O_CLOEXEC,00) ERR#2 'No such file or directory' 0.003477134 open("/var/run/ld-elf.so.hints",O_RDONLY|O_CLOEXEC,010002076) = 3 (0x3) 0.003652394 read(3,"Ehnt\^A\0\0\0\M^@\0\0\0G\0\0\0\0"...,128) = 128 (0x80) 0.004297290 fstat(3,{ mode=-r--r--r-- ,inode=242567,size=199,blksize=32768 }) = 0 (0x0) 0.004543592 pread(3,"/lib:/usr/lib:/usr/lib/compat:/u"...,71,0x80) = 71 (0x47) 0.004779113 close(3) = 0 (0x0) 0.005155623 open("/lib/libc.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,04) = 3 (0x3) 0.005312654 fstat(3,{ mode=-r--r--r-- ,inode=82461,size=1997448,blksize=32768 }) = 0 (0x0) 0.005582810 mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 2175680512 (0x81ae4000) 0.005825675 mmap(0x0,4403200,PROT_NONE,MAP_GUARD|MAP_ALIGNED_SUPER,-1,0x0) = 2208301056 (0x83a00000) 0.006280101 mmap(0x83a00000,602112,PROT_READ,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 2208301056 (0x83a00000) 0.007208695 mmap(0x83aa2000,1331200,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x92000) = 2208964608 (0x83aa2000) 0.007523590 mmap(0x83bf6000,45056,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x1d6000) = 2210357248 (0x83bf6000) 0.007911142 mmap(0x83c10000,28672,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x1e0000) = 2210463744 (0x83c10000) 0.008256350 mmap(0x83c17000,2211840,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_ANON,-1,0x0) = 2210492416 (0x83c17000) 0.008580048 munmap(0x81ae4000,4096) = 0 (0x0) 0.008813017 close(3) = 0 (0x0) 0.009140204 open("/lib/libsys.so.7",O_RDONLY|O_CLOEXEC|O_VERIFY,04) = 3 (0x3) 0.009339475 fstat(3,{ mode=-r--r--r-- ,inode=80624,size=97568,blksize=32768 }) = 0 (0x0) 0.009655673 mmap(0x0,4096,PROT_READ,MAP_PRIVATE|MAP_PREFAULT_READ,3,0x0) = 2167148544 (0x812c1000) 0.009903381 mmap(0x0,294912,PROT_NONE,MAP_GUARD|MAP_ALIGNED_SUPER,-1,0x0) = 2223964160 (0x848f0000) 0.010187860 mmap(0x848f0000,81920,PROT_READ,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x0) = 2223964160 (0x848f0000) 0.010519891 mmap(0x84913000,20480,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE|MAP_PREFAULT_READ,3,0x13000) = 2224107520 (0x84913000) 0.010822651 mmap(0x84927000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x17000) = 2224189440 (0x84927000) 0.011201974 mmap(0x84937000,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED|MAP_PREFAULT_READ,3,0x17000) = 2224254976 (0x84937000) 0.011549057 munmap(0x812c1000,4096) = 0 (0x0) 0.011789526 close(3) = 0 (0x0) 0.012868327 mprotect(0x84927000,4096,PROT_READ) = 0 (0x0) 0.013741348 mprotect(0x83bf6000,45056,PROT_READ) = 0 (0x0) 0.013941608 munmap(0x1c68ba61f000,8192) = 0 (0x0) 0.014210566 mmap(0x0,147456,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) = 31236129157120 (0x1c68ba61f000) 0.014771972 exterrctl(0x1,0x0,0x83c113b0) = 0 (0x0) 0.015194472 readlink("/etc/malloc.conf",0x802a08d0,1024) ERR#2 'No such file or directory' 0.015449368 issetugid() = 0 (0x0) 0.015866451 mmap(0x0,2097152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(21),-1,0x0) = 31236131127296 (0x1c68ba800000) 0.016668482 mmap(0x0,2097152,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(12),-1,0x0) = 31236133224448 (0x1c68baa00000) 0.016997075 mmap(0x0,4194304,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON|MAP_ALIGNED(21),-1,0x0) = 31236135321600 (0x1c68bac00000) 0.017500929 cpuset_getaffinity(0x3,0x9,0xffffffffffffffff,0x80,0x802a0d40) = 0 (0x0) 0.017799210 mprotect(0x220000,4096,PROT_READ) = 0 (0x0) 0.021428115 SIGNAL 11 (SIGSEGV) code=SEGV_ACCERR trapno=36 addr=0x83c01220 0.187707774 process killed, signal = 11 (core dumped) andy@dns2:~ $ I' currently on -RELEASE; switching to -CURRENT would take some time, but if necessary, I can try.
Many thanks for the data. Unfortunately, the problem has become more complicated, so I need another day to collect all the facts. Switching to the current version is not necessary yet, thank you. I'm afraid that we have another bug in the VM layer again. It looks like thread local storage is unmapped in the middle of program execution. Don't ask me why!
It has now been confirmed as Cortex-A53 errata. The simplest way to fix it is to add CPUTYPE=cortex-a53 to /etc/make.conf and then recompile the whole system..
Thanks for the update, Michal! Guess I'm going to wait for an official fix, "make buildworld" on a Pi Zero 2 is no fun, and I don't have a proper cross-compile environment right now.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=f1e8b0ff4e13b52c5e41a5eea3e686410af3dd0b commit f1e8b0ff4e13b52c5e41a5eea3e686410af3dd0b Author: Andrew Turner <andrew@FreeBSD.org> AuthorDate: 2026-07-14 15:07:30 +0000 Commit: Andrew Turner <andrew@FreeBSD.org> CommitDate: 2026-07-14 15:47:15 +0000 bsd.cpu.mk: Add a workaround for erratum 843419 Add a workaround for the Arm Cortex-A53 erratum 843419. This has been targeted when the build is either unoptimised for any CPU/architecture or targets the Cortex-A53 or ARMv8.0 architecture. PR: 296240 PR: 296395 Reported by: Hal Murray <halmurray+freebsd@sonic.net> Reported by: Andreas Schuh <x55839@icloud.com> Reviewed by: cognet, mmel Sponsored by: Arm Ltd Differential Revision: https://reviews.freebsd.org/D58212 share/mk/bsd.cpu.mk | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
So that's why random processes crash on my Raspberry Pi 3. This needs an errata patch if we want people to belief ARM64 is a tier 1 architecture not somebody's tier 3 playground.