Re: [PATCH] Fix bug using dwarf_next_unit to iterate over .debug_types

Re: [PATCH] Fix bug using dwarf_next_unit to iterate over .debug_types

[Josh Stone]

On 03/21/2012 07:54 AM, Tom Tromey wrote:
> If you call dwarf_next_unit to iterate over .debug_types, then call
> dwarf_offdie_types, you can see a failure if some earlier call
> happened to call __libdw_intern_next_unit via dwarf_formref_die.
> 
> What happens is that __libdw_intern_next_unit updates the Dwarf's
> next_tu_offset, but does not add the TU to the TU search tree.  So,
> the call to dwarf_offdie_types does not find the TU in the tree, and
> will not search any more, causing a failure.

Hi Tom, can you clarify this failure mode?

I'm seeing a segfault in your debugtypes.exp test added to systemtap,
with my poor unpatched elfutils-0.153 on F16.  The call to
dwarf_offdie_types is returning NULL, which the calling code is not
prepared for.

So is the NULL return the extent of the failure?  Or is elfutils
generally borked after that?

And even apart from this bug, should we be ready for NULL return from
dwarf_offdie_types() anyway?  Same question for dwarf_offdie(), I guess.

Thanks,
Josh

Re: [PATCH] Fix bug using dwarf_next_unit to iterate over .debug_types

[Mark Wielaard]

On Thu, 2012-04-12 at 15:22 -0700, Josh Stone wrote:
> I'm seeing a segfault in your debugtypes.exp test added to systemtap,
> with my poor unpatched elfutils-0.153 on F16.  The call to
> dwarf_offdie_types is returning NULL, which the calling code is not
> prepared for.
> 
> So is the NULL return the extent of the failure?  Or is elfutils
> generally borked after that?
> 
> And even apart from this bug, should we be ready for NULL return from
> dwarf_offdie_types() anyway?  Same question for dwarf_offdie(), I guess.

NULL can be returned fir dwarf_offdie () or dwarf_offdie_types () when
you give an offset that isn't really a DIE offset inside the debug_info
or debug_types section or when invalid DWARF is encountered. In such
cases NULL is returned and dwarf_errno () is set. The bug was in the
code that associated the right CU or TU with the returned Dwarf_Die. The
CU/TU is cached, but before the bug the cache could become bad and then
even valid offsets could fail, but the bug only impacted
dwarf_offdie_types ().

Cheers,

Mark