From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id EFCAD385770C; Tue, 6 Feb 2024 21:33:17 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org EFCAD385770C DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1707255197; bh=/RJtjt45FSo5C3usUOWpt/wMMUDB88VMpTSzK3f8FOM=; h=From:To:Subject:Date:In-Reply-To:References:From; b=NnmYZvXn+AXMLBBFEKFJfAQgLnfAbxE6hiTT50n6FjlWu+VDjhgjWhv2Z2u5u4uaf 7UsKtKsNWiFWQiLTtsmRCdDgooXwcuYhIX4E/JaVSl3bzyeNoeD+FZQYcDrkDF21Gx vFcpO2u4z+RmxI6grL8brAhTGnsZLi+75Nl+gjgA= From: "cvs-commit at gcc dot gnu.org" To: gdb-prs@sourceware.org Subject: [Bug tdep/31254] [gdb/tdep, arm] FAIL: gdb.threads/staticthreads.exp: up 10 Date: Tue, 06 Feb 2024 21:33:17 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gdb X-Bugzilla-Component: tdep X-Bugzilla-Version: HEAD X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: cvs-commit at gcc dot gnu.org X-Bugzilla-Status: RESOLVED X-Bugzilla-Resolution: FIXED X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: 15.1 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://sourceware.org/bugzilla/show_bug.cgi?id=3D31254 --- Comment #28 from Sourceware Commits --- The gdb-14-branch branch has been updated by Thiago Bauermann : https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;h=3D7c709b26ba13= 1f2a978aca373df6467a43510d28 commit 7c709b26ba131f2a978aca373df6467a43510d28 Author: Tom de Vries Date: Mon Feb 5 11:04:06 2024 +0100 [gdb/tdep] Fix use-after-free in arm_exidx_fill_cache On arm-linux the linaro CI occasionally reports: ... (gdb) up 10 #4 0x0001b864 in pthread_join () (gdb) FAIL: gdb.threads/staticthreads.exp: up 10 ... while this is expected: ... (gdb) up 10 #3 0x00010568 in main (argc=3D1, argv=3D0xfffeede4) at staticthreads.= c:76 76 pthread_join (thread, NULL); (gdb) PASS: gdb.threads/staticthreads.exp: up 10 ... Thiago investigated the problem, and using valgrind found an invalid re= ad in arm_exidx_fill_cache. The problem happens as follows: - an objfile and corresponding per_bfd are allocated - some memory is allocated in arm_exidx_new_objfile using objfile->objfile_obstack, for the "exception table entry cache". - a symbol reread is triggered, and the objfile, including the objfile_obstack, is destroyed - a new objfile is allocated, using the same per_bfd - again arm_exidx_new_objfile is called, but since the same per_bfd is used, it doesn't allocate any new memory for the "exception table entry cac= he". - the "exception table entry cache" is accessed by arm_exidx_fill_cache, and we have a use-after-free. This is a regression since commit a2726d4ff80 ("[ARM] Store exception handling information per-bfd instead of per-objfile"), which changed the "except= ion table entry cache" from per-objfile to per-bfd, but failed to update the obstack_alloc. Fix this by using objfile->per_bfd->storage_obstack instead of objfile->objfile_obstack. I couldn't reproduce the FAIL myself, but Thiago confirmed that the pat= ch fixes it. Tested on arm-linux. Approved-By: Luis Machado PR tdep/31254 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=3D31254 --=20 You are receiving this mail because: You are on the CC list for the bug.=