[PATCH] gdb/infcall: Fix freed frame dereferenced in inferior call

[PATCH] gdb/infcall: Fix freed frame dereferenced in inferior call

[Toby Lloyd Davies]

Between the store to frame and it's use by get_frame_sp (frame) there is
a call to find_function_addr(). If the function is a IFUNC then this can
do another inferior call. This results in the frame cache being
invalidated which frees all frames. Then the frame pointer previously
stored is left dangling and get_frame_sp (frame) may segfault.
---
 gdb/infcall.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/gdb/infcall.c b/gdb/infcall.c
index 8252feea074..15dce04c984 100644
--- a/gdb/infcall.c
+++ b/gdb/infcall.c
@@ -938,6 +938,7 @@ call_function_by_hand_dummy (struct value *function,
 
   /* Ensure that the initial SP is correctly aligned.  */
   {
+    frame = get_current_frame ();
     CORE_ADDR old_sp = get_frame_sp (frame);
 
     if (gdbarch_frame_align_p (gdbarch))
-- 
2.34.1

Re: [PATCH] gdb/infcall: Fix freed frame dereferenced in inferior call

[Tom Tromey]

>>>>> "Toby" == Toby Lloyd Davies <tlloyddavies@undo.io> writes:

Toby> Between the store to frame and it's use by get_frame_sp (frame) there is
Toby> a call to find_function_addr(). If the function is a IFUNC then this can
Toby> do another inferior call. This results in the frame cache being
Toby> invalidated which frees all frames. Then the frame pointer previously
Toby> stored is left dangling and get_frame_sp (frame) may segfault.

This sounds like exactly the kind of bug that should have been fixed by
the frame_info_ptr change -- stale frame_info pointer are no longer
possible.

Was this patch made against an older version of gdb?

If it's still a bug, it might be good to have more information about it.
Also a test case would be handy.

thanks,
Tom

Re: [PATCH] gdb/infcall: Fix freed frame dereferenced in inferior call

[Toby Lloyd Davies]

> Was this patch made against an older version of gdb?

Yes. You're right that this is now fixed so this patch is no longer needed.

Thanks,
Toby


On Thu, 11 Jan 2024 at 17:26, Tom Tromey <tom@tromey.com> wrote:
>
> >>>>> "Toby" == Toby Lloyd Davies <tlloyddavies@undo.io> writes:
>
> Toby> Between the store to frame and it's use by get_frame_sp (frame) there is
> Toby> a call to find_function_addr(). If the function is a IFUNC then this can
> Toby> do another inferior call. This results in the frame cache being
> Toby> invalidated which frees all frames. Then the frame pointer previously
> Toby> stored is left dangling and get_frame_sp (frame) may segfault.
>
> This sounds like exactly the kind of bug that should have been fixed by
> the frame_info_ptr change -- stale frame_info pointer are no longer
> possible.
>
> Was this patch made against an older version of gdb?
>
> If it's still a bug, it might be good to have more information about it.
> Also a test case would be handy.
>
> thanks,
> Tom