From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by sourceware.org (Postfix) with ESMTPS id 7D6A33858CDA for ; Mon, 5 Feb 2024 18:49:44 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7D6A33858CDA Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=linaro.org ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7D6A33858CDA Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::102c ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707158986; cv=none; b=qOHzMrSokXqz8Ucczblnp+HVkgUGygrZPyvLROQBXar2im7BbjPPrkwwRF7W5RcX+2ntHOoyII3POtnHKLIMMkBPsXlQlEaD81pXeP25JiGGHYaHa2PENTMzQFWprszt+3GlTFTxZzLxhIpUCIyImTbfcivfvM61/WhPUcgmJ64= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707158986; c=relaxed/simple; bh=oymjS34maM/Oce2CE9aC5b98n+2iqjuEXND828EJiKk=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=dbR1A7VF6w8MEIvRzgUSSLQkvf4OTQJ9v1W4hMDPAx/UXkSY/+FVpqKmA89fn/0aucBKGmyOpqNR9oKgN8qJ8nk5NfTAxklEdf0O/QqmHwolWi+iYfw0jHpY9sAEhToj+gKv0eSVecZoL3f+F0OWV3ahoonSjVJomUwtzRmxv9Y= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-pj1-x102c.google.com with SMTP id 98e67ed59e1d1-29041136f73so3249500a91.0 for ; Mon, 05 Feb 2024 10:49:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1707158983; x=1707763783; darn=sourceware.org; h=mime-version:message-id:date:in-reply-to:subject:cc:to:from :user-agent:references:from:to:cc:subject:date:message-id:reply-to; bh=w0FgnbCxyN9op70eqiI4jf2BP8o63CSVErQIthYf1G4=; b=WeJcphhIiSFJWjhnPeZSWWtibNjsof9Phhgyosnr+i6iQv35uQ+tN4jjGiIbubcQd2 AXOA7Ho4QtLGkbQQiok1CRVj/K9xXcrLH4gVGvpKDXg1LDdZWOZ78/BoqGDjm028L0ap 2hXsVtJa+VL/0TsfG0lz1jMNJKWaaTuZ5CkR6DMwUT7WPOwxGHV6OaX3axDKKFapRNeW 8g8clHeSJ74wjxzM7oPb6U/Pf8qExmzixOx5ZsiyG6pUAucFOvUVdHH/zX4FGEyo5Q3D iX2Z3aiC9ygXY5BqhX99i/+U3fixhJi+eD5WHkjtUN6wx7GzYiGYivJMz6FmwZYszaz4 LEww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1707158983; x=1707763783; h=mime-version:message-id:date:in-reply-to:subject:cc:to:from :user-agent:references:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=w0FgnbCxyN9op70eqiI4jf2BP8o63CSVErQIthYf1G4=; b=J+A1YiYyc4zAS3O2U8RM8mTLRhrdUa4TOGukKHGQaMa4OxYE5knHNWKRG+GX5n2gF7 jTOEskNql09ldS/tuuu5b63uxVFs41kdL+zIyagHuxotTZBPNXe4zbfGa19J+Gi0/1Wd yB7pCGItT938z7sNnxszY0IM2osOOsQYxyoXKqlLR366Ya3fAN1TqjPpSvfNciBRdhXR um7CgqXMmCeSFF9fLyj3h0Po1fbSt0hBpTpD/b3F+QIgJT4+6CcePFTiP5jmIyapxQ1x G+yabGVg0AbcX5TnSKWkvvTWAyLnB/lgwE0njPa/iLfjNncxlhO+90cd8079sREiMNtP Iy0w== X-Gm-Message-State: AOJu0YyNFf9mybZIT7SkQhut0vlECe/+wrzjEQPgKx7tfOegxAyaGqih 2i7Z2/RxX+TJlKqnwo8FBlMeJ3VAYTHvgN52KuoneFLDcJQCZjClnAmEZmDRxSk= X-Google-Smtp-Source: AGHT+IFcFFSlkRJI3d4rZltON/p/diDY+I29VmaIcvfgLA6f3SvY89Wbgh/W73B6ftOzzYwuhWMJIA== X-Received: by 2002:a17:90a:db8d:b0:28d:c4ff:74a2 with SMTP id h13-20020a17090adb8d00b0028dc4ff74a2mr301281pjv.47.1707158983514; Mon, 05 Feb 2024 10:49:43 -0800 (PST) X-Forwarded-Encrypted: i=0; AJvYcCWACTynjOaLKzzjPQlmUtASJz/7fYzCMCJ8PrDmKgpO4OAXLAYmVHZhWFUO1RYjuzIPEREcP5DXig6sxRLCn2O/Hb7Ah1059L+jJQ== Received: from localhost ([2804:14d:7e39:8470:3e0f:c572:eb80:5a11]) by smtp.gmail.com with ESMTPSA id f6-20020a17090ac28600b00296a7ac8b5fsm1777504pjt.6.2024.02.05.10.49.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 05 Feb 2024 10:49:43 -0800 (PST) References: <20240205055440.8889-1-tdevries@suse.de> <7cd725bb-8b54-4389-a822-200f02e72391@arm.com> User-agent: mu4e 1.10.8; emacs 29.1 From: Thiago Jung Bauermann To: Luis Machado Cc: Tom de Vries , gdb-patches@sourceware.org Subject: Re: [PATCH] [gdb/tdep] Fix use-after-free in arm_exidx_fill_cache In-reply-to: <7cd725bb-8b54-4389-a822-200f02e72391@arm.com> Date: Mon, 05 Feb 2024 15:49:41 -0300 Message-ID: <87zfwebvay.fsf@linaro.org> MIME-Version: 1.0 Content-Type: text/plain X-Spam-Status: No, score=-11.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,GIT_PATCH_0,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Luis Machado writes: > On 2/5/24 05:54, Tom de Vries wrote: >> On arm-linux the linaro CI occasionally reports: >> ... >> (gdb) up 10 >> #4 0x0001b864 in pthread_join () >> (gdb) FAIL: gdb.threads/staticthreads.exp: up 10 >> ... >> while this is expected: >> ... >> (gdb) up 10 >> #3 0x00010568 in main (argc=1, argv=0xfffeede4) at staticthreads.c:76 >> 76 pthread_join (thread, NULL); >> (gdb) PASS: gdb.threads/staticthreads.exp: up 10 >> ... >> >> Thiago investigated the problem, and using valgrind found an invalid read in >> arm_exidx_fill_cache. >> >> The problem happens as follows: >> - an objfile and corresponding per_bfd are allocated >> - some memory is allocated in arm_exidx_new_objfile using >> objfile->objfile_obstack, for the "exception table entry cache". >> - a symbol reread is triggered, and the objfile, including the >> objfile_obstack, is destroyed >> - a new objfile is allocated, using the same per_bfd >> - again arm_exidx_new_objfile is called, but since the same per_bfd is used, >> it doesn't allocate any new memory for the "exception table entry cache". >> - the "exception table entry cache" is accessed by arm_exidx_fill_cache, >> and we have a use-after-free. >> >> This is a regression since commit a2726d4ff80 ("[ARM] Store exception handling >> information per-bfd instead of per-objfile"), which changed the "exception >> table entry cache" from per-objfile to per-bfd, but failed to update the >> obstack_alloc. >> >> Fix this by using objfile->per_bfd->storage_obstack instead of >> objfile->objfile_obstack. >> >> I couldn't reproduce the FAIL myself, but Thiago confirmed that the patch >> fixes it. >> >> Tested on arm-linux. >> >> PR tdep/31254 >> Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31254 >> --- >> gdb/arm-tdep.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/gdb/arm-tdep.c b/gdb/arm-tdep.c >> index 0d0431e0d1c..861d50a6a3b 100644 >> --- a/gdb/arm-tdep.c >> +++ b/gdb/arm-tdep.c >> @@ -2701,7 +2701,7 @@ arm_exidx_new_objfile (struct objfile *objfile) >> if (n_bytes || n_words) >> { >> gdb_byte *p = entry >> - = (gdb_byte *) obstack_alloc (&objfile->objfile_obstack, >> + = (gdb_byte *) obstack_alloc (&objfile->per_bfd->storage_obstack, >> n_bytes + n_words * 4 + 1); >> >> while (n_bytes--) >> >> base-commit: 029e52bac7f3a6dd8b39f7f3d298b73174da806b > > Looks like I missed a spot in the per-bfd conversion there. > > Thanks Thiago and Tom for the investigation and fix. This is OK. > > Approved-By: Luis Machado Could this patch also be committed to the GDB 14 branch? -- Thiago