Re: [PATCH 0/3] Fix use-after-free in gdb/corelow.c + cleanups

[John Baldwin <jhb@FreeBSD.org>]

On 5/31/23 9:04 AM, Lancelot SIX via Gdb-patches wrote:
> Hi,
> 
> Since a recent change if BFD (014a602b86f "Don't optimise bfd_seek to
> same position"), I started to see ASAN report a use-after-free error
> when opening some coredumps.
> 
> If the original process had some file mapped in its address space that
> GDB can open, but calling bfd_check_format on this file fails, GDB would
> close the BFD but keep a pointer to it for later use, leading to
> use-after-free.
> 
> Such scenario can be seen when the original process had some IO pages
> mapped from a DRI render node (/dev/dri/renderD$NUM) as it is the case
> when offloading compute tasks to AMDGPU devices.
> 
> The first patch in this series fixes the use-after-free error.
> 
> Once this issue fixed, GDB does show a warning message once for each
> region in the process address space where the special file was mapped.
> This is un-necessarily noisy, and does not match what is done when GDB
> does not find the file to open (exec_find_file returns null).  The
> second patch of the series ensures that the warning message can only be
> printed once per file.
> 
> Finally, the third patch in this series ensures that GDB does not try to
> open a file if it has already failed to open it.
> 
> Since I am not sure how I can write a simple test to exercise for this
> failure, I have not included one.  I have tested this series on a system
> using an AMDGPU device, where I originally encountered the problem.
> 
> Lancelot SIX (3):
>    gdb/corelow.c: fix use-after-free in build_file_mappings
>    gdb/corelow.c: avoid repeated warnings in build_file_mappings
>    gdb/corelow.c: do not try to reopen a file if open failed once
> 
>   gdb/corelow.c | 35 ++++++++++++++++++++---------------
>   1 file changed, 20 insertions(+), 15 deletions(-)
> 
> 
> base-commit: a15891aaea006d06066573449efbda353dd2863e

Patches 2 and 3 look good to me.

-- 
John Baldwin