lib/56940: libexecinfo fails to trace stack through signal trampoline for SIGSEGV call to null function pointer

[campbell+netbsd%mumble.net@localhost]

>Number:         56940
>Category:       lib
>Synopsis:       libexecinfo fails to trace stack through signal trampoline for SIGSEGV call to null function pointer
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jul 25 22:35:00 +0000 2022
>Originator:     Taylor R Campbell
>Release:        current
>Organization:
El Fundacion NetBSD
>Environment:
being consumed by an insatiable thirst for oil
>Description:
When invoked from a signal handler for the SIGSEGV delivered due to a call to a null function pointer, the backtrace(3) functions of libexecinfo bottom out at __sigtramp_siginfo_2 or equivalent, and fail to yield return addresses for the call site of the null function pointer or its callers.

The information is available -- for example, on amd64, r15 of the signal trampoline frame points to a ucontext_t structure with process state where rsp[0] holds the return address and &rsp[1] is where parent frame lives.  But libunwind fails to find this information, and so the stack trace ends at the signal trampoline.
>How-To-Repeat:
#include <sys/cdefs.h>

#include <err.h>
#include <execinfo.h>
#include <setjmp.h>
#include <signal.h>
#include <stddef.h>
#include <stdio.h>

void (*f)(void);
jmp_buf env;
void *stack[64];
size_t stackdepth;
char **symbols;

void
sigsegv(int signo)
{

	(void)signo;

	stackdepth = backtrace(stack, __arraycount(stack));
	longjmp(env, 1);
}

int
main(void)
{
	size_t i;

	if (signal(SIGSEGV, &sigsegv) == SIG_ERR)
		err(1, "signal(SIGSEGV)");
	if (setjmp(env) == 0)
		(*f)();
	symbols = backtrace_symbols(stack, stackdepth);
	if (symbols == NULL)
		err(1, "backtrace_symbols");
	for (i = 0; i < stackdepth; i++)
		printf("%s\n", symbols[i]);
	fflush(stdout);
	return ferror(stdout);
}

>Fix:
Yes, please!