From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id D08AA3858C5E; Mon, 5 Feb 2024 10:04:22 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org D08AA3858C5E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1707127462; bh=wYlCViE5EQyHEgYhjQrgpwMRANlQl5EZ0InflrhKMLQ=; h=From:To:Subject:Date:In-Reply-To:References:From; b=a70m+m+gIMPPjfPQl3ZCHibSw/frpYzKvI0mN4yKwOBSTQp9zcq+ZSkU6mFkUR9C7 KcUUhkAl1iWKpXKIgbzJpkw0vh/xmuzjHBBdtjinQAOkjKMN/V8INnhl0CARkmp1vh 0UX/kpOiDvWkHU4EW5Mxh3Y93EMjA5hNddHcNpws= From: "cvs-commit at gcc dot gnu.org" To: gdb-prs@sourceware.org Subject: [Bug gdb/31254] [gdb, arm] FAIL: gdb.threads/staticthreads.exp: up 10 Date: Mon, 05 Feb 2024 10:04:21 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gdb X-Bugzilla-Component: gdb X-Bugzilla-Version: HEAD X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: cvs-commit at gcc dot gnu.org X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://sourceware.org/bugzilla/show_bug.cgi?id=3D31254 --- Comment #25 from Sourceware Commits --- The master branch has been updated by Tom de Vries : https://sourceware.org/git/gitweb.cgi?p=3Dbinutils-gdb.git;h=3Dbae2a57f4c07= f46093e7bf00fec2554868e77189 commit bae2a57f4c07f46093e7bf00fec2554868e77189 Author: Tom de Vries Date: Mon Feb 5 11:04:06 2024 +0100 [gdb/tdep] Fix use-after-free in arm_exidx_fill_cache On arm-linux the linaro CI occasionally reports: ... (gdb) up 10 #4 0x0001b864 in pthread_join () (gdb) FAIL: gdb.threads/staticthreads.exp: up 10 ... while this is expected: ... (gdb) up 10 #3 0x00010568 in main (argc=3D1, argv=3D0xfffeede4) at staticthreads.= c:76 76 pthread_join (thread, NULL); (gdb) PASS: gdb.threads/staticthreads.exp: up 10 ... Thiago investigated the problem, and using valgrind found an invalid re= ad in arm_exidx_fill_cache. The problem happens as follows: - an objfile and corresponding per_bfd are allocated - some memory is allocated in arm_exidx_new_objfile using objfile->objfile_obstack, for the "exception table entry cache". - a symbol reread is triggered, and the objfile, including the objfile_obstack, is destroyed - a new objfile is allocated, using the same per_bfd - again arm_exidx_new_objfile is called, but since the same per_bfd is used, it doesn't allocate any new memory for the "exception table entry cac= he". - the "exception table entry cache" is accessed by arm_exidx_fill_cache, and we have a use-after-free. This is a regression since commit a2726d4ff80 ("[ARM] Store exception handling information per-bfd instead of per-objfile"), which changed the "except= ion table entry cache" from per-objfile to per-bfd, but failed to update the obstack_alloc. Fix this by using objfile->per_bfd->storage_obstack instead of objfile->objfile_obstack. I couldn't reproduce the FAIL myself, but Thiago confirmed that the pat= ch fixes it. Tested on arm-linux. Approved-By: Luis Machado PR tdep/31254 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=3D31254 --=20 You are receiving this mail because: You are on the CC list for the bug.=