[Bug tdep/31254] [gdb/tdep, arm] FAIL: gdb.threads/staticthreads.exp: up 10

["cvs-commit at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=31254

--- Comment #28 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The gdb-14-branch branch has been updated by Thiago Bauermann
<bauermann@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=7c709b26ba131f2a978aca373df6467a43510d28

commit 7c709b26ba131f2a978aca373df6467a43510d28
Author: Tom de Vries <tdevries@suse.de>
Date:   Mon Feb 5 11:04:06 2024 +0100

    [gdb/tdep] Fix use-after-free in arm_exidx_fill_cache

    On arm-linux the linaro CI occasionally reports:
    ...
     (gdb) up 10
     #4  0x0001b864 in pthread_join ()
     (gdb) FAIL: gdb.threads/staticthreads.exp: up 10
    ...
    while this is expected:
    ...
     (gdb) up 10
     #3  0x00010568 in main (argc=1, argv=0xfffeede4) at staticthreads.c:76
     76          pthread_join (thread, NULL);
     (gdb) PASS: gdb.threads/staticthreads.exp: up 10
    ...

    Thiago investigated the problem, and using valgrind found an invalid read
in
    arm_exidx_fill_cache.

    The problem happens as follows:
    - an objfile and corresponding per_bfd are allocated
    - some memory is allocated in arm_exidx_new_objfile using
      objfile->objfile_obstack, for the "exception table entry cache".
    - a symbol reread is triggered, and the objfile, including the
      objfile_obstack, is destroyed
    - a new objfile is allocated, using the same per_bfd
    - again arm_exidx_new_objfile is called, but since the same per_bfd is
used,
      it doesn't allocate any new memory for the "exception table entry cache".
    - the "exception table entry cache" is accessed by arm_exidx_fill_cache,
      and we have a use-after-free.

    This is a regression since commit a2726d4ff80 ("[ARM] Store exception
handling
    information per-bfd instead of per-objfile"), which changed the "exception
    table entry cache" from per-objfile to per-bfd, but failed to update the
    obstack_alloc.

    Fix this by using objfile->per_bfd->storage_obstack instead of
    objfile->objfile_obstack.

    I couldn't reproduce the FAIL myself, but Thiago confirmed that the patch
    fixes it.

    Tested on arm-linux.

    Approved-By: Luis Machado <luis.machado@arm.com>

    PR tdep/31254
    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31254

-- 
You are receiving this mail because:
You are on the CC list for the bug.