Dear Maintainer,

I was using gdbserver to run 32-bit binary on a 64-bit machine. I ran
`gdbserver localhost:1234 ./32bit-exe` on one terminal, and
`gdb -ex "target remote :1234" -ex "c"` on another terminal. At this point, it
segfaults somewhere in glibc when trying to access a gs memory segment:

   0xf7de43ea <__ctype_init+10> push   ebx
   0xf7de43eb <__ctype_init+11> mov    edx, DWORD PTR [eax-0x16c]
   0xf7de43f1 <__ctype_init+17> mov    ebx, DWORD PTR [eax-0x140]
 → 0xf7de43f7 <__ctype_init+23> mov    edx, DWORD PTR gs:[edx]
   0xf7de43fa <__ctype_init+26> mov    edx, DWORD PTR [edx]
   0xf7de43fc <__ctype_init+28> mov    ecx, DWORD PTR [edx+0x24]
   0xf7de43ff <__ctype_init+31> add    ecx, 0x100
   0xf7de4405 <__ctype_init+37> mov    DWORD PTR gs:[ebx], ecx
   0xf7de4408 <__ctype_init+40> mov    ecx, DWORD PTR [edx+0x28]

Obviously, it was expected for this to not segfault here and crash, but it
crashed here.

Here I wrote a simple PoC of the same reproducable bug except without glibc
(i.e.
freestanding statically-linked binary) to show that the same error seems to
exist, tho this time you would have to single-step through gdb through
gdbserver
in order to trigger the segfault bug:
https://gist.github.com/theKidOfArcrania/cdba7c7ff42f95a0cfa2be897ca928db

This bug seems to be the underlying cause of this other bug in pwntools (which
directly uses gdbserver to open up a gdb instance):
https://github.com/Gallopsled/pwntools/issues/1783

Dear Maintainer,
tried to reproduce this issue inside a minimal qemu VM and
found that this starts to manifest with kernel version 5.9.
Using a kernel 5.8 with current testing userland does
not show this issue.

These tests were done with qemu parameter "-cpu host".
Without any cpu parameter I could not detect this fault in this VM.

Unfortunately I read the linked issue too late were investigation
continued already (and points to a gdb upstream patch),
so this seems to be a feature, added to the kernel, uncovering
this bug in gdbserver.
Building a gdb package, with this upstream patch included,
does not show this issue.

Kind regards,
Bernhard

Dear Maintainer,
I guess #990309 is about the same issue.
Unfortunately the upstream patch did appear
just in the gdb-11-branch, which is not
yet available in Debian.

Kind regards,
Bernhard

Version: 11.2-1

If this is indeed the same bug as #990309, then it's fixed in 11.2-1
in unstable.

    smcv