From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2111) id DC9853858C53; Sat, 4 May 2024 16:55:55 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DC9853858C53 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1714841755; bh=o8AI5D5lNfbBlEmWt4lEWbdVJPqVfvfGMeP+wxv9sb8=; h=From:To:Subject:Date:From; b=mc1WnwccwV447KPKTQtSEImbF1NhJ9byXq7t4PGpoY1KmeIPxVa647OlmEa8IDkvK s0WFbycaxOcp7hTaR5hDXZFoOqUYp/SFuH6mLca79BNek95NunWpoNYLed10d9ZGed CuY8FPCWgHjP5fjtPhNFYY7l3oWkjnbT8UdUswn0= Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: Hannes Domani To: gdb-cvs@sourceware.org Subject: [binutils-gdb] Fix heap-use-after-free in index-cached with --disable-threading X-Act-Checkin: binutils-gdb X-Git-Author: Hannes Domani X-Git-Refname: refs/heads/master X-Git-Oldrev: b42d685452f7b797dd87ff2856e1959a975e902a X-Git-Newrev: 5140d8e013b0d8ab560b1bb8c72e0a8b2e96ac4b Message-Id: <20240504165555.DC9853858C53@sourceware.org> Date: Sat, 4 May 2024 16:55:55 +0000 (GMT) List-Id: https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;h=3D5140d8e013b0= d8ab560b1bb8c72e0a8b2e96ac4b commit 5140d8e013b0d8ab560b1bb8c72e0a8b2e96ac4b Author: Hannes Domani Date: Sat May 4 18:55:20 2024 +0200 Fix heap-use-after-free in index-cached with --disable-threading =20 If threads are disabled, either by --disable-threading explicitely, or = by missing std::thread support, you get the following ASAN error when loading symbols: =20 =3D=3D7310=3D=3DERROR: AddressSanitizer: heap-use-after-free on address= 0x614000002128 at pc 0x00000098794a bp 0x7ffe37e6af70 sp 0x7ffe37e6af68 READ of size 1 at 0x614000002128 thread T0 #0 0x987949 in index_cache_store_context::store() const ../../gdb/d= warf2/index-cache.c:163 #1 0x943467 in cooked_index_worker::write_to_cache(cooked_index con= st*, deferred_warnings*) const ../../gdb/dwarf2/cooked-index.c:601 #2 0x1705e39 in std::function::operator()() const /gcc/9/i= nclude/c++/9.2.0/bits/std_function.h:690 #3 0x1705e39 in gdb::task_group::impl::~impl() ../../gdbsupport/tas= k-group.cc:38 =20 0x614000002128 is located 232 bytes inside of 408-byte region [0x614000= 002040,0x6140000021d8) freed by thread T0 here: #0 0x7fd75ccf8ea5 in operator delete(void*, unsigned long) ../../..= /./libsanitizer/asan/asan_new_delete.cc:177 #1 0x9462e5 in cooked_index::index_for_writing() ../../gdb/dwarf2/c= ooked-index.h:689 #2 0x9462e5 in operator() ../../gdb/dwarf2/cooked-index.c:657 #3 0x9462e5 in _M_invoke /gcc/9/include/c++/9.2.0/bits/std_function= .h:300 =20 It's happening because cooked_index_worker::wait always returns true in this case, which tells cooked_index::wait it can delete the m_state cooked_index_worker member, but cooked_index_worker::write_to_cache tri= es to access it immediately afterwards. =20 Fixed by making cooked_index_worker::wait only return true if desired_s= tate is CACHE_DONE, same as if threading was enabled, so m_state will not be prematurely deleted. =20 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=3D31694 Approved-By: Tom Tromey Diff: --- gdb/dwarf2/cooked-index.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gdb/dwarf2/cooked-index.c b/gdb/dwarf2/cooked-index.c index 3b95c075a55..767f119e04f 100644 --- a/gdb/dwarf2/cooked-index.c +++ b/gdb/dwarf2/cooked-index.c @@ -513,7 +513,7 @@ cooked_index_worker::wait (cooked_state desired_state, = bool allow_quit) #else /* Without threads, all the work is done immediately on the main thread, and there is never anything to wait for. */ - done =3D true; + done =3D desired_state =3D=3D cooked_state::CACHE_DONE; #endif /* CXX_STD_THREAD */ =20 /* Only the main thread is allowed to report complaints and the