From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2045.outbound.protection.outlook.com [40.107.93.45]) by sourceware.org (Postfix) with ESMTPS id 40CEB3858C41 for ; Thu, 1 Jun 2023 10:47:09 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 40CEB3858C41 Authentication-Results: sourceware.org; dmarc=fail (p=quarantine dis=none) header.from=amd.com Authentication-Results: sourceware.org; spf=fail smtp.mailfrom=amd.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DwuKfHshIacMpxcqL70Bkfii+5zDXEoLZzi9tewo7i1h8up6w+U1ZwNWGd+ipx73nf2+jsNGtwbwqk/1cQGuvf7wjJt51lI9EJ9UgKbGKkN9j4GISwwv+48Y+AvpXJhY0wodvYQdUBrwzK7YJHwELITXkLFy4HEFl/gsSAi0i9HXfcR7X+rg9KyTlzgRnWV2PKg1rg3CLTHjGmPiuismUhegfEnw3D+KhMvClI9/4y1Q/l2Mxoy2/SCuY8BmPTKTQBY+O45CIjPK9ya7nNqXdFwThwENLOwW2rPDlAPkXVshmK/sFJTIl3HvGYw8OPUQLBtyYUmhhtLpE4NwrUnOug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MrNCD+TLEXzRfxfFDUQW5W+Qj66S1KBfuInbzo7dizw=; b=ii6wegs4kMrt1pMETQfXIE1aoWXgyt52a/fTnVWo0Af+ZFJ2IdkbmVH7B/HiLBNSgdhyMo4iVcaBCgAB7LY1TIY1lWMJBl+E0lNJsr61HZWspfewyiyeHE7PNIz+W6QWLlqX/nvFSJFDokVLFZGQplgMIieM4MgPpLZTcmTWonsmpIlOphxJx/Z2xj/g9Nf35PxceICVih+6z4vLdGwWk1ZR6cthsat/5GD3fm7C+y4Q0UxqdtSNZmNo8IptY2vJ3lkPd4H9ihZOJlGfVptUWEpQMDuTJBQXxqOL6h/7TDd0wXmxKmWwOTQvShu9bomU60tOayA5pRptRYJJDoOyug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=redhat.com smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MrNCD+TLEXzRfxfFDUQW5W+Qj66S1KBfuInbzo7dizw=; b=R3scP0n0Q8fi4WjYXIuWQMASJ9EGaEELrWUzXVBetyvHFAqjpKanV8/TWMP+rp47bvNT5bdAG7l3w66FcGgxW7yulD3S96zf9tZAQlLAWjaVHiD9tMgDxOa6G3LsL5VXjL1DsToCuX48zlPuWfvz7J4Dl/eXIyz8RHNsb4bzmUg= Received: from DM6PR21CA0013.namprd21.prod.outlook.com (2603:10b6:5:174::23) by CH0PR12MB8529.namprd12.prod.outlook.com (2603:10b6:610:18d::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6455.23; Thu, 1 Jun 2023 10:47:06 +0000 Received: from DM6NAM11FT061.eop-nam11.prod.protection.outlook.com (2603:10b6:5:174:cafe::86) by DM6PR21CA0013.outlook.office365.com (2603:10b6:5:174::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6477.9 via Frontend Transport; Thu, 1 Jun 2023 10:47:06 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by DM6NAM11FT061.mail.protection.outlook.com (10.13.173.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6455.23 via Frontend Transport; Thu, 1 Jun 2023 10:47:06 +0000 Received: from khazad-dum.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Thu, 1 Jun 2023 05:47:04 -0500 From: Lancelot SIX To: , CC: , , Subject: [PATCH v2 1/3] gdb/corelow.c: fix use-after-free in build_file_mappings Date: Thu, 1 Jun 2023 11:45:40 +0100 Message-ID: <20230601104540.156137-1-lancelot.six@amd.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <87ttvr4i9z.fsf@redhat.com> References: <87ttvr4i9z.fsf@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DM6NAM11FT061:EE_|CH0PR12MB8529:EE_ X-MS-Office365-Filtering-Correlation-Id: 628c32fc-1480-4c9b-5d8c-08db628d8b03 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: zpdR3ckXKJW13xG+2x8saJ7T9WNIViw8k1N9LvShU0XfBUW9oNUcwvjkXhA42sGvFWXA0HA3hSwTD08RJSyvdB98sSWzXGNarFOcMlRxxRkXcYC23oBS3akwxv0wOVD/BCld0D14Dm5s1XUdz8NisjDXRjErleWtlxHrnf3cgduY0/9OyDJXRvV6ypgZTau7fddnO+L5PXCobkYxzmnwden4Iu0CWMD8w7ILsCwRBQiee+goug1Hx3nA/gI0bNKbQZ0pYwJkWyrZODDnprWYcHfOQ0nUC6KppFSz/LYkPQoO7OKBMJSwGdsKTtPC+u+dO4jwC3JoQdG/XRHmB2KxOULuNxRr/qr/GCOmxPy4NK/M+AkKC4HuPK3QQMPHNy8JeYUcht8BzhEFEqCyQ/D3/Go+xIP9a1g4SH/xzEXreS0tLDbIwDGf0H4DowTZE480MYPnkRczJUQUwRTmOkHXi+AJFJ1M+VpR8YBrq1njM15jLxGjJytTmPNttmiXWgOtxznw00HdksLRE3/ehFMFms8BE6cZ5eHjaoLAbvKPestKjEEkxaikVHzX7bYJvnnepRGCow+WmZMfaQ7NSdWH+AyoN9CNvEtKKWfi6/9ewx0H2eccEElcpHfooaSohQc9ygl7XDFiBRX6Zu7yk4TZpHgPZXC00nyziA745tB8cZNz9jlm+roou2ViQ0LZ0068gjCGkR1g1GIuP7gm11eTRtgqyOPer1/M1DcxQwGZIS90OTFp51MwzG9AJlwjcVW5iBTFaCSI8M80AOJCK5kHrA== X-Forefront-Antispam-Report: CIP:165.204.84.17;CTRY:US;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:SATLEXMB04.amd.com;PTR:InfoDomainNonexistent;CAT:NONE;SFS:(13230028)(4636009)(39860400002)(346002)(376002)(136003)(396003)(451199021)(46966006)(36840700001)(40470700004)(82740400003)(81166007)(36756003)(356005)(86362001)(82310400005)(40460700003)(8936002)(8676002)(41300700001)(5660300002)(26005)(1076003)(40480700001)(2906002)(186003)(16526019)(336012)(426003)(47076005)(83380400001)(2616005)(6666004)(316002)(7696005)(70206006)(70586007)(110136005)(54906003)(478600001)(36860700001)(4326008)(36900700001);DIR:OUT;SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2023 10:47:06.4284 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 628c32fc-1480-4c9b-5d8c-08db628d8b03 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT061.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR12MB8529 X-Spam-Status: No, score=-11.5 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Hi, Thanks John and Andrew for the reviews and suggestions. Here is a V2 for patch #1 (I have added Andrew's Reviewed-By tag to patch 2 and 3). John, should I add your Reviewed-By tag in patches 2 and 3 as you reviewed them as well? Changes since V1: - Only register the bfd in bfd_map if it got successfully opened, following John's suggestion. I have not used the exact pattern suggested in the review to avoid duplicating the warning message. Best, Lancelot. --- In core_target::build_file_mappings, GDB tries to open files referenced in the core dump. The process goes like this: struct bfd *bfd = bfd_map[filename]; if (bfd == nullptr) { bfd = bfd_map[filename] = bfd_openr (expanded_fname.get (), "binary"); if (bfd == nullptr || !bfd_check_format (bfd, bfd_object)) { if (bfd != nullptr) bfd_close (bfd); return; } } asection *sec = bfd_make_section_anyway (bfd, "load"); ... The problem is that if bfd_check_format fails, we close the bfd but keep a reference to it in the bfd_map. If the same filename appears another time in the NT_FILE note, we enter this code again. The second time, bfd_map[filename] is not nullptr and we try to call bfd_make_section_anyway on an already closed BFD, which is a use-after-free error. This patch makes sure that the bfd is only saved in the bfd_map if it got opened successfully. This error got exposed by a recent change in BFD (014a602b86f "Don't optimise bfd_seek to same position"). Since this change, opening a coredump which contains mapping to some special files such as a DRI render node (/dev/dri/renderD$NUM) exposes the issue. This happens for example for processes using AMDGPU devices to offload compute tasks. --- gdb/corelow.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gdb/corelow.c b/gdb/corelow.c index db489b4280e..54def4198bc 100644 --- a/gdb/corelow.c +++ b/gdb/corelow.c @@ -258,8 +258,7 @@ core_target::build_file_mappings () return; } - bfd = bfd_map[filename] = bfd_openr (expanded_fname.get (), - "binary"); + bfd = bfd_openr (expanded_fname.get (), "binary"); if (bfd == nullptr || !bfd_check_format (bfd, bfd_object)) { @@ -284,6 +283,7 @@ core_target::build_file_mappings () This can be checked before/after a core file detach via "maint info bfds". */ gdb_bfd_record_inclusion (core_bfd, bfd); + bfd_map[filename] = bfd; } /* Make new BFD section. All sections have the same name, -- 2.34.1