| Summary: | heap-use-after-free in index-cache | ||
|---|---|---|---|
| Product: | gdb | Reporter: | Hannes Domani <ssbssa> |
| Component: | symtab | Assignee: | Not yet assigned to anyone <unassigned> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | bernd.edlinger, ssbssa, tromey |
| Priority: | P2 | ||
| Version: | HEAD | ||
| Target Milestone: | 15.1 | ||
| Host: | Target: | ||
| Build: | Last reconfirmed: | ||
| Attachments: | heob output as html | ||
|
Description
Hannes Domani
2024-05-02 14:06:52 UTC
Created attachment 15488 [details]
heob output as html
ed29a346be439466ff2a5ce33e715e02c49fbdac is the first bad commit commit ed29a346be439466ff2a5ce33e715e02c49fbdac Author: Tom Tromey <tom@tromey.com> Date: Sun Jan 28 09:14:04 2024 -0700 Avoid race when writing to index cache The background DWARF reader changes introduced a race when writing to the index cache. The problem here is that constructing the index_cache_store_context object should only happen on the main thread, to ensure that the various value captures do not race. This patch adds an assert to the construct to that effect, and then arranges for this object to be constructed by the cooked_index_worker constructor -- which is only invoked on the main thread. Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31262 gdb/dwarf2/cooked-index.c | 27 ++++++++++++--------------- gdb/dwarf2/cooked-index.h | 15 ++++++++++----- gdb/dwarf2/index-cache.c | 4 ++++ 3 files changed, 26 insertions(+), 20 deletions(-) The master branch has been updated by Hannes Domani <ssbssa@sourceware.org>: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5140d8e013b0d8ab560b1bb8c72e0a8b2e96ac4b commit 5140d8e013b0d8ab560b1bb8c72e0a8b2e96ac4b Author: Hannes Domani <ssbssa@yahoo.de> Date: Sat May 4 18:55:20 2024 +0200 Fix heap-use-after-free in index-cached with --disable-threading If threads are disabled, either by --disable-threading explicitely, or by missing std::thread support, you get the following ASAN error when loading symbols: ==7310==ERROR: AddressSanitizer: heap-use-after-free on address 0x614000002128 at pc 0x00000098794a bp 0x7ffe37e6af70 sp 0x7ffe37e6af68 READ of size 1 at 0x614000002128 thread T0 #0 0x987949 in index_cache_store_context::store() const ../../gdb/dwarf2/index-cache.c:163 #1 0x943467 in cooked_index_worker::write_to_cache(cooked_index const*, deferred_warnings*) const ../../gdb/dwarf2/cooked-index.c:601 #2 0x1705e39 in std::function<void ()>::operator()() const /gcc/9/include/c++/9.2.0/bits/std_function.h:690 #3 0x1705e39 in gdb::task_group::impl::~impl() ../../gdbsupport/task-group.cc:38 0x614000002128 is located 232 bytes inside of 408-byte region [0x614000002040,0x6140000021d8) freed by thread T0 here: #0 0x7fd75ccf8ea5 in operator delete(void*, unsigned long) ../../.././libsanitizer/asan/asan_new_delete.cc:177 #1 0x9462e5 in cooked_index::index_for_writing() ../../gdb/dwarf2/cooked-index.h:689 #2 0x9462e5 in operator() ../../gdb/dwarf2/cooked-index.c:657 #3 0x9462e5 in _M_invoke /gcc/9/include/c++/9.2.0/bits/std_function.h:300 It's happening because cooked_index_worker::wait always returns true in this case, which tells cooked_index::wait it can delete the m_state cooked_index_worker member, but cooked_index_worker::write_to_cache tries to access it immediately afterwards. Fixed by making cooked_index_worker::wait only return true if desired_state is CACHE_DONE, same as if threading was enabled, so m_state will not be prematurely deleted. Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31694 Approved-By: Tom Tromey <tom@tromey.com> Fixed. |