From 0832e20dde6ebe71a1245935f4a41308368b6094 Mon Sep 17 00:00:00 2001 From: Andrew Burgess Date: Mon, 26 Dec 2022 09:03:19 +0100 Subject: [PATCH] [gdb] Fix segfault during inferior call to ifunc With a simple test-case: ... $ cat test.c char *p = "a"; int main (void) { return strlen (p); } $ gcc -g test.c ... we run into this segfault: ... $ gdb -q -batch a.out -ex start -ex "p strlen (p)" Temporary breakpoint 1 at 0x1151: file test.c, line 4. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Temporary breakpoint 1, main () at test.c:4 4 return strlen (p); Fatal signal: Segmentation fault ... The strlen is an ifunc, and consequently during the call to call_function_by_hand_dummy for "p strlen (p)" another call to call_function_by_hand_dummy is used to resolve the ifunc. This invalidates the get_current_frame () result in the outer call. Fix this by using prepare_reinflate and reinflate. Note that this series ( https://inbox.sourceware.org/gdb-patches/20221214033441.499512-1-simon.marchi@polymtl.ca/ ) should address this problem, but this patch is a simpler fix which is easy to backport. Tested on x86_64-linux. Co-Authored-By: Tom de Vries PR gdb/29941 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=29941 --- gdb/infcall.c | 3 +++ gdb/testsuite/gdb.base/gnu-ifunc.exp | 9 +++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/gdb/infcall.c b/gdb/infcall.c index c1db3e22189..ec9669a6b6a 100644 --- a/gdb/infcall.c +++ b/gdb/infcall.c @@ -848,6 +848,7 @@ call_function_by_hand_dummy (struct value *function, bool stack_temporaries = thread_stack_temporaries_enabled_p (call_thread.get ()); frame = get_current_frame (); + frame.prepare_reinflate (); gdbarch = get_frame_arch (frame); if (!gdbarch_push_dummy_call_p (gdbarch)) @@ -863,6 +864,8 @@ call_function_by_hand_dummy (struct value *function, "target calling convention."), get_function_name (funaddr, name_buf, sizeof (name_buf))); + frame.reinflate (); + if (values_type == NULL || values_type->is_stub ()) values_type = default_return_type; if (values_type == NULL) diff --git a/gdb/testsuite/gdb.base/gnu-ifunc.exp b/gdb/testsuite/gdb.base/gnu-ifunc.exp index 715f5be04cb..3b3d5cb3742 100644 --- a/gdb/testsuite/gdb.base/gnu-ifunc.exp +++ b/gdb/testsuite/gdb.base/gnu-ifunc.exp @@ -240,14 +240,19 @@ proc misc_tests {resolver_attr resolver_debug final_debug} { # Test GDB will automatically indirect the call. if {!$resolver_debug && !$final_debug} { + # Do the test that is supposed to succeed first, to make sure + # elf_gnu_ifunc_record_cache is empty. This excercises PR28224. + gdb_test "p (int) gnu_ifunc (3)" " = 4" + gdb_test "p gnu_ifunc()" \ "'${dot}final' has unknown return type; cast the call to its declared return type" gdb_test "p gnu_ifunc (3)" \ "'${dot}final' has unknown return type; cast the call to its declared return type" - gdb_test "p (int) gnu_ifunc (3)" " = 4" } else { - gdb_test "p gnu_ifunc()" "Too few arguments in function call\\." + # Do the test that is supposed to succeed first, see above. gdb_test "p gnu_ifunc (3)" " = 4" + + gdb_test "p gnu_ifunc()" "Too few arguments in function call\\." } # Test that the resolver received its argument. -- 2.34.1