drgn 0.3.0

This release hardens drgn against untrusted debugging information and core dumps and adds a few features.

New features:

• QEMU guest debugging has been optimized to read memory directly from the QEMU process when possible.
• irq_get_nr_irqs() was added to drgn.helpers.linux.irq. It gets the number of IRQs on the system.
• task_group_sched_entity() was added to drgn.helpers.linux.sched. It gets the scheduler entity of a task group on a given CPU.
• s390x and ppc64 dumps without virtual memory segments are now supported. Contributed by Jimmy Brisson.
• The crash bpf command now supports the -s option for displaying BPF map or program structures, along with the -x and -d options for controlling its formatting. Contributed by Suchit Karunakaran.
• A partial implementation of the crash net command was added. Contributed by Praveen Kumar Kannoju.
• The LoongArch64 architecture is now recognized. Contributed by George Guo.
• Linux 7.2 is now supported.
  • The crash irq command was updated to handle the nr_irqs global variable being renamed.
  • A test case was updated to handle the removal of struct task_group::se.
• Linux 7.3 is now supported.
  • drgn.helpers.linux.fs.path_lookup() was updated to handle changes to the root filesystem of the initial mount namespace.
  • tools/fsrefs.py was updated to handle changes to binfmt_misc.
  • drgn.helpers.linux.sched.cfs_rq_for_each_entity() was updated to handle changes to task groups.

Other improvements:

• drgn.Program.main_thread() and drgn.Program.crashed_thread() now raise LookupError instead of Exception if the thread is not found.
• Operations that cannot be supported on a given program or object now raise a new exception type, drgn.UnsupportedOperation, instead of ValueError. drgn.UnsupportedOperation inherits from ValueError, so existing code that catches the latter should not break.
• Iterating over a module iterator or module section iterator after the underlying set of modules/sections has been modified now raises RuntimeError instead of Exception.
• Most operations that encounter malformed data (DWARF, ELF, etc.) now raise a new exception type, drgn.BadDataError, instead of Exception.
• Address ranges for loaded userspace modules are now page-aligned, and a module whose segments are not contiguous now has multiple address ranges. Note that this may require the use of drgn.Module.address_ranges instead of drgn.Module.address_range.

Bug fixes:

• Address translation in a userspace context was fixed for core dumps without virtual memory segments. Contributed by Jimmy Brisson.
• Float-to-integer conversions on drgn.Object are now always defined.
• A null pointer dereference when calling stack_trace() with an object with anonymous type was fixed.
• A missing space in a set_enabled_*_finders() error message was fixed.
• A memory leak in an error path in drgn.Program.enum_type() was fixed.
• AArch64 PAC mask handling from userspace core dumps of a different byte order than the host was fixed.
• The ccr register on ppc64 is now read correctly from core dumps and the Linux kernel.
• An infinite loop in drgn.StackFrame.locals() when a DW_TAG_enumerator DIE doesn't have a DW_AT_name was fixed.
• Kallsyms parsing was fixed to consistently determine the length of names. Contributed by Stephen Brennan.
• Python symbol finders were fixed to not truncate addresses to 32 bits on 32-bit hosts and to initialize the symbol lifetime.
• A misleading debug log message in drgn.Program.load_module_debug_info() for modules whose debugging information is not wanted was fixed.
• Getting an incomplete member of a value object was fixed to return an absent object instead of erroring.
• drgn.Object.format_(implicit_members=False) and drgn.Object.value_() were fixed for objects with incomplete members.
• drgn.Program.set_linux_kernel_custom() was fixed to reject a program with existing virtual memory segments.
• drgn.Program.set_qemu_qmp() was fixed to not reset an already-initialized program.
• A bug in ORC unwinder sorting and lookups was fixed.
• DWARF indexing was fixed to correctly handle long stretches of attributes that it skips.
• NT_PRPSINFO and NT_PRSTATUS note lookups were fixed to only match notes with the exact name "CORE", not a prefix of that.
• Formatting of functions that return a pointer to a function or array was fixed.
• A case where a module address range overlap was missed is now caught.
• Parsing of a-f hexadecimal digits, the 0X prefix, and invalid octals in drgn.Program.type() and drgn.offsetof() was fixed.
• Types from DWARF with a byte size >= 2^31 are now handled correctly.
• C++ type lookups with an identifier that is followed by something other than template arguments were fixed.
• Handling of GNU-compressed .zdebug_str sections was fixed.
• A couple of cases where the address mask wasn't applied when evaluating a DWARF expression were fixed.
• The helper that the drgn CLI uses to open /proc/kcore via sudo now runs Python in isolated mode so that standard library modules can't be shadowed.
• key in prog and key in stack_frame now return False for a key that is not a string instead of raising an exception.
• A crash when calling drgn.Program.__contains__() or drgn.StackFrame.__contains__() directly instead of using the in operator was fixed.
• An address range overlap error when the segments of two userspace modules are interleaved (e.g., on AArch64 when the vDSO is mapped in a gap between the program interpreter's segments) was fixed. Contributed by Stephen Brennan.
• Many memory safety bugs (buffer overflow, out-of-bounds access, null pointer dereference, use-after-free, double-free, uninitialized memory read), undefined behavior bugs (integer overflow, invalid arithmetic operations), and memory leaks were fixed. Some can be triggered by crafted inputs. Others require a user running pathological code.
• Many missing error checks were fixed.
• Excessive recursion in various operations caused by deeply nested or cyclic types or namespaces is now limited.
• A double file descriptor close when loading kernel module section information was fixed.
• Build errors with GCC 16, glibc 2.43, and C23 were fixed.
• On 32-bit builds, drgn now uses at most 8 threads by default to avoid running out of virtual address space on machines with many CPUs.

Documentation:

• Exception documentation was made more concise.

contrib directory:

• Several improvements were made to contrib/pstack.py, and its dump and dump-print modes were removed. Contributed by Stephen Brennan.

Internal:

• Documentation for how to add support for new architectures was updated. Contributed by Charlie Jenkins.
• Tests that require a kernel module that isn't available are now skipped. Contributed by Alexandra Hájková.