From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp-out2.suse.de (smtp-out2.suse.de [195.135.223.131]) by sourceware.org (Postfix) with ESMTPS id B46603858C39 for ; Tue, 9 Apr 2024 09:27:43 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B46603858C39 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org B46603858C39 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=195.135.223.131 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712654866; cv=none; b=vi3SL1ziWk3uvDJNs7VPl8CpJ8Fy27Yp0nNESvVk4NncJu9JO8Kp6Uu8HDIIq4391ol7hrq792bQQdMcX+aXp2ulBPu64BKPIzBF51vo5aN2B4OR2PiqVxQk56saD7wZMkmUe5nf/zGi37+y8JgQGxAsDy2zBSuJSJ874w9a/Ps= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1712654866; c=relaxed/simple; bh=pswF/imywELjOKgweWttdurGitHnW86qYAXpDQuLjGM=; h=DKIM-Signature:DKIM-Signature:DKIM-Signature:DKIM-Signature:From: To:Subject:Date:Message-Id:MIME-Version; b=KUOwSN7a9QTvf+RCEXvPQFR9N8trofcFHbNZfA0ui4+IVks6UVKRHdhXkbA7WGu67znPiM8YE7iIBl55ls+o5pirand4vGiOdSHmNbrRQH/PbYLtwHzk8BwvphHr31WhQPOuCdqGXMEpf01UAbgFuGP5aXHkhCzducOfo3sJvoc= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [10.150.64.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out2.suse.de (Postfix) with ESMTPS id B1432208EC for ; Tue, 9 Apr 2024 09:27:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1712654862; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=F2BCg4IkLKVyW5PCwJkgFH8bEQJAwYPCzkjksa99UAA=; b=gRdy1Jd99+G20XZGeJV3hINgZLnEKnyqHGnCeKMamhWeGKWniVLaOLb1hnYOswyn0Nv/eQ bMyrvbkohPuDc+zDnGCH1GvMwjbJHlnLFg8iWAiPh2sK0n71oyWFNRLNOt5IQdQSqHrSGG BPB6MBgIikm9jRDdFEwjEBQTpuIzXVU= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1712654862; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=F2BCg4IkLKVyW5PCwJkgFH8bEQJAwYPCzkjksa99UAA=; b=b6vj4yJTwQCGTn+QrJ3JQNBLDRlbuk3vhl8htMPXEKJGo3Oxkpplaxxr9l5RPM1yV0gm2x 8ESlhUHMMyzDwvCw== Authentication-Results: smtp-out2.suse.de; none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1712654862; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=F2BCg4IkLKVyW5PCwJkgFH8bEQJAwYPCzkjksa99UAA=; b=gRdy1Jd99+G20XZGeJV3hINgZLnEKnyqHGnCeKMamhWeGKWniVLaOLb1hnYOswyn0Nv/eQ bMyrvbkohPuDc+zDnGCH1GvMwjbJHlnLFg8iWAiPh2sK0n71oyWFNRLNOt5IQdQSqHrSGG BPB6MBgIikm9jRDdFEwjEBQTpuIzXVU= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1712654862; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=F2BCg4IkLKVyW5PCwJkgFH8bEQJAwYPCzkjksa99UAA=; b=b6vj4yJTwQCGTn+QrJ3JQNBLDRlbuk3vhl8htMPXEKJGo3Oxkpplaxxr9l5RPM1yV0gm2x 8ESlhUHMMyzDwvCw== Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 9C7DD136D9 for ; Tue, 9 Apr 2024 09:27:42 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id cSsCJQ4KFWbgWwAAD6G6ig (envelope-from ) for ; Tue, 09 Apr 2024 09:27:42 +0000 From: Tom de Vries To: gdb-patches@sourceware.org Subject: [PATCH v5 1/2] [gdb/symtab] Fix an out of bounds array access in find_epilogue_using_linetable Date: Tue, 9 Apr 2024 11:27:52 +0200 Message-Id: <20240409092753.10567-1-tdevries@suse.de> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Level: X-Spamd-Result: default: False [-2.80 / 50.00]; BAYES_HAM(-3.00)[100.00%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; R_MISSING_CHARSET(0.50)[]; NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain]; FUZZY_BLOCKED(0.00)[rspamd.com]; RCVD_VIA_SMTP_AUTH(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; ARC_NA(0.00)[]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; DBL_BLOCKED_OPENRESOLVER(0.00)[suse.de:email,imap1.dmz-prg2.suse.org:helo,imap1.dmz-prg2.suse.org:rdns]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; MIME_TRACE(0.00)[0:+]; RCVD_COUNT_TWO(0.00)[2]; TO_MATCH_ENVRCPT_ALL(0.00)[]; TO_DN_NONE(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[gdb-patches@sourceware.org]; RCVD_TLS_ALL(0.00)[] X-Spam-Score: -2.80 X-Spam-Status: No, score=-12.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: From: Bernd Edlinger An out of bounds array access in find_epilogue_using_linetable causes random test failures like these: FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: $fba_value == $fn_fba FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: check frame-id matches FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: bt 2 FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: up FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: $sp_value == $::main_sp FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: $fba_value == $::main_fba FAIL: gdb.base/unwind-on-each-insn-amd64.exp: foo: instruction 6: [string equal $fid $::main_fid] Here the read happens below the first element of the line table, and the test failure depends on the value that is read from there. It also happens that std::lower_bound returns a pointer exactly at the upper bound of the line table, also here the read value is undefined, that happens in this test: FAIL: gdb.dwarf2/dw2-epilogue-begin.exp: confirm watchpoint doesn't trigger Fixes: 528b729be1a2 ("gdb/dwarf2: Add support for DW_LNS_set_epilogue_begin in line-table") Co-Authored-By: Tom de Vries PR symtab/31268 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31268 --- gdb/symtab.c | 94 ++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 84 insertions(+), 10 deletions(-) diff --git a/gdb/symtab.c b/gdb/symtab.c index 86603dfebc3..e032178aaa6 100644 --- a/gdb/symtab.c +++ b/gdb/symtab.c @@ -4156,6 +4156,9 @@ find_epilogue_using_linetable (CORE_ADDR func_addr) if (!find_pc_partial_function (func_addr, nullptr, &start_pc, &end_pc)) return {}; + /* While the standard allows for multiple points marked with epilogue_begin + in the same function, for performance reasons, this function will only + find the last address that sets this flag for a given block. */ const struct symtab_and_line sal = find_pc_line (start_pc, 0); if (sal.symtab != nullptr && sal.symtab->language () != language_asm) { @@ -4166,24 +4169,95 @@ find_epilogue_using_linetable (CORE_ADDR func_addr) = unrelocated_addr (end_pc - objfile->text_section_offset ()); const linetable *linetable = sal.symtab->linetable (); - /* This should find the last linetable entry of the current function. - It is probably where the epilogue begins, but since the DWARF 5 - spec doesn't guarantee it, we iterate backwards through the function - until we either find it or are sure that it doesn't exist. */ + if (linetable == nullptr || linetable->nitems == 0) + { + /* Empty line table. */ + return {}; + } + + /* Find the first linetable entry after the current function. Note that + this also may be an end_sequence entry. */ auto it = std::lower_bound (linetable->item, linetable->item + linetable->nitems, unrel_end, [] (const linetable_entry <e, unrelocated_addr pc) { return lte.unrelocated_pc () < pc; }); + if (it == linetable->item + linetable->nitems) + { + /* We couldn't find either: + - a linetable entry starting the function after the current + function, or + - an end_sequence entry that terminates the current function + at unrel_end. + + This can happen when the linetable doesn't describe the full + extent of the function. This can be triggered with: + - compiler-generated debug info, in the cornercase that the pc + with which we call find_pc_line resides in a different file + than unrel_end, or + - invalid dwarf assembly debug info. + In the former case, there's no point in iterating further, simply + return "not found". In the latter case, there's no current + incentive to attempt to support this, so handle this + conservatively and do the same. */ + return {}; + } - while (it->unrelocated_pc () >= unrel_start) - { - if (it->epilogue_begin) - return {it->pc (objfile)}; - it --; - } + if (unrel_end < it->unrelocated_pc ()) + { + /* We found a line entry that starts past the end of the + function. This can happen if the previous entry straddles + two functions, which shouldn't happen with compiler-generated + debug info. Handle the corner case conservatively. */ + return {}; + } + gdb_assert (unrel_end == it->unrelocated_pc ()); + + /* Move to the last linetable entry of the current function. */ + if (it == &linetable->item[0]) + { + /* Doing it-- would introduce undefined behaviour, avoid it by + explicitly handling this case. */ + return {}; + } + it--; + if (it->unrelocated_pc () < unrel_start) + { + /* Not in the current function. */ + return {}; + } + gdb_assert (it->unrelocated_pc () < unrel_end); + + /* We're at the the last linetable entry of the current function. This + is probably where the epilogue begins, but since the DWARF 5 spec + doesn't guarantee it, we iterate backwards through the current + function until we either find the epilogue beginning, or are sure + that it doesn't exist. */ + for (; it >= &linetable->item[0]; it--) + { + if (it->unrelocated_pc () < unrel_start) + { + /* No longer in the current function. */ + break; + } + + if (it->epilogue_begin) + { + /* Found the beginning of the epilogue. */ + return {it->pc (objfile)}; + } + + if (it == &linetable->item[0]) + { + /* No more entries in the current function. + Doing it-- would introduce undefined behaviour, avoid it by + explicitly handling this case. */ + break; + } + } } + return {}; } base-commit: 9132c8152b899a1683bc886f8ba76bedadb48aa1 -- 2.35.3