Bug 17355 - Crash on Python frame filters with unreadable arg
Summary: Crash on Python frame filters with unreadable arg
Status: RESOLVED FIXED
Alias: None
Product: gdb
Classification: Unclassified
Component: python (show other bugs)
Version: 7.8
: P2 normal
Target Milestone: 7.8
Assignee: Jan Kratochvil
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-07 12:09 UTC by Jan Kratochvil
Modified: 2014-09-07 12:23 UTC (History)
1 user (show)

See Also:
Host: x86_64-linux-gnu
Target: x86_64-linux-gnu
Build:
Last reconfirmed:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jan Kratochvil 2014-09-07 12:09:04 UTC
https://bugzilla.redhat.com/show_bug.cgi?id=1126177

[New LWP 8203]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `gdb --core=d /usr/bin/anjuta'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  value_type (value=value@entry=0x0) at ../../gdb/value.c:932
932	  return value->type;

Thread 1 (Thread 0x7f7e44958800 (LWP 8203)):
#0  value_type (value=value@entry=0x0) at ../../gdb/value.c:932
No locals.
#1  0x00000000005616f0 in py_print_single_arg (out=0x2e9f220, sym_name=0x0, fa=0x7fff09338f70, fv=<optimized out>, opts=0x7fff09338fb0, args_type=CLI_SCALAR_VALUES, print_args_field=0, language=0x8d9e40 <c_language_defn>) at ../../gdb/python/py-framefilter.c:445
        cleanups = 0x88a9a0 <sentinel_cleanup>
        val = 0x0
        except = {reason = 0, error = GDB_NO_ERROR, message = 0x0}
#2  0x00000000005623ba in enumerate_args (iter=0x0, iter@entry=<listiterator at remote 0x7f7e3713c410>, out=0x7fff09338e00, out@entry=0x2e9f220, args_type=1116932672, args_type@entry=CLI_SCALAR_VALUES, print_args_field=print_args_field@entry=0, frame=0x1, frame@entry=0xa9f3fd8) at ../../gdb/python/py-framefilter.c:596
        arg = {sym = 0xb3b0720, val = 0x0, error = 0xae442f0 "value has been optimized out", entry_kind = 0x8a54ae <print_entry_values_no> "no"}
        entryarg = {sym = 0xb3b0720, val = 0x0, error = 0x0, entry_kind = 0x8a54ae <print_entry_values_no> "no"}
        language = 0x8d9e40 <c_language_defn>
        sym = 0xb3b0720
        val = 0x0
        sym_name = 0xa0c0ff0 "data"
        opts = {prettyformat = Val_prettyformat_default, prettyformat_arrays = 0, prettyformat_structs = 0, vtblprint = 0, unionprint = 1, addressprint = 1, objectprint = 0, print_max = 200, repeat_count_threshold = 10, output_format = 0, format = 0, stop_print_at_null = 0, print_array_indexes = 0, deref_ref = 1, static_field_print = 1, pascal_static_field_print = 1, raw = 0, summary = 1, symbol_print = 1}
        except = {reason = 0, error = GDB_NO_ERROR, message = 0x0}
#3  0x0000000000562624 in py_print_args (filter=filter@entry=<FrameDecorator(_base=<gdb.Frame at remote 0x7f7e3713c470>) at remote 0x7f7e3713c8d0>, out=out@entry=0x2e9f220, args_type=args_type@entry=CLI_SCALAR_VALUES, frame=frame@entry=0xa9f3fd8) at ../../gdb/python/py-framefilter.c:968
        old_chain = 0x71863e0
        except = {reason = 0, error = GDB_NO_ERROR, message = 0x0}
#4  0x0000000000562c28 in py_print_frame (filter=filter@entry=<FrameDecorator(_base=<gdb.Frame at remote 0x7f7e3713c470>) at remote 0x7f7e3713c8d0>, flags=flags@entry=7, args_type=args_type@entry=CLI_SCALAR_VALUES, out=out@entry=0x2e9f220, indent=indent@entry=0, levels_printed=levels_printed@entry=0x67844f0) at ../../gdb/python/py-framefilter.c:1236
        has_addr = <optimized out>
        address = <optimized out>
        gdbarch = <optimized out>
        frame = <optimized out>
        cleanup_stack = 0xae4d290
        opts = {prettyformat = Val_prettyformat_default, prettyformat_arrays = 0, prettyformat_structs = 0, vtblprint = 0, unionprint = 1, addressprint = 1, objectprint = 0, print_max = 200, repeat_count_threshold = 10, output_format = 0, format = 0, stop_print_at_null = 0, print_array_indexes = 0, deref_ref = 0, static_field_print = 1, pascal_static_field_print = 1, raw = 0, summary = 0, symbol_print = 1}
        py_inf_frame = <optimized out>
        elided = <optimized out>
        print_level = 1
        print_frame_info = <optimized out>
        print_args = <optimized out>
        print_locals = 0
        except = {reason = 0, error = GDB_NO_ERROR, message = 0x0}
#5  0x00000000005635c0 in gdbpy_apply_frame_filter (extlang=<optimized out>, frame=0xa9aa650, flags=7, args_type=CLI_SCALAR_VALUES, out=0x2e9f220, frame_low=0, frame_high=-1) at ../../gdb/python/py-framefilter.c:1518
        gdbarch = 0x3096380
        cleanups = 0xabb1ca0
        success = <optimized out>
        except = {reason = 0, error = GDB_NO_ERROR, message = 0x0}
        item = <FrameDecorator(_base=<gdb.Frame at remote 0x7f7e3713c470>) at remote 0x7f7e3713c8d0>
        levels_printed = 0x67844f0
        count_printed = <optimized out>
#6  0x000000000060ecfa in apply_ext_lang_frame_filter (frame=0xa9aa650, flags=7, args_type=CLI_SCALAR_VALUES, out=0x2e9f220, frame_low=1, frame_low@entry=0, frame_high=-1) at ../../gdb/extension.c:553
        status = 0
        extlang = 0x0
#7  0x0000000000608b57 in backtrace_command_1 (count_exp=count_exp@entry=0x0, show_locals=0, no_filters=0, from_tty=from_tty@entry=1) at ../../gdb/stack.c:1801
        flags = 7
        arg_type = CLI_SCALAR_VALUES
        fi = <optimized out>
        count = <optimized out>
        i = <optimized out>
        trailing = 0xa9aa650
        trailing_level = <optimized out>
        py_start = 0
        py_end = -1
        result = EXT_LANG_BT_ERROR
#8  0x000000000060903d in backtrace_command (arg=0x0, from_tty=1) at ../../gdb/stack.c:1916
        old_chain = 0xacb0680
        fulltrace_arg = <optimized out>
        arglen = <optimized out>
        argc = <optimized out>
        no_filters = <optimized out>
        user_arg = <optimized out>
Comment 1 Jan Kratochvil 2014-09-07 12:09:30 UTC
[patch+7.8?] Fix crash on Python frame filters with unreadable arg
https://sourceware.org/ml/gdb-patches/2014-08/msg00364.html
Message-ID: <20140819215646.GA8129@host2.jankratochvil.net>
Comment 2 cvs-commit@gcc.gnu.org 2014-09-07 12:13:07 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "gdb and binutils".

The branch, master has been updated
       via  c75bd3a23915c3122070a95e1974e323543ffbe4 (commit)
      from  3f9d8762a4b24873f22197d004a8710e9a8557ca (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=c75bd3a23915c3122070a95e1974e323543ffbe4

commit c75bd3a23915c3122070a95e1974e323543ffbe4
Author: Jan Kratochvil <jan.kratochvil@redhat.com>
Date:   Sun Sep 7 14:09:59 2014 +0200

    Fix crash on Python frame filters with unreadable arg
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1126177
    
    ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x000000992bef sp 0x7ffff9039530 bp 0x7ffff9039540
    T0)
        #0 0x992bee in value_type .../gdb/value.c:925
        #1 0x87c951 in py_print_single_arg python/py-framefilter.c:445
        #2 0x87cfae in enumerate_args python/py-framefilter.c:596
        #3 0x87e0b0 in py_print_args python/py-framefilter.c:968
    
    It crashes because frame_arg::val is documented it may contain NULL
    (frame_arg::error is then non-NULL) but the code does not handle it.
    
    Another bug is that py_print_single_arg() calls goto out of its TRY_CATCH
    which messes up GDB cleanup chain crashing GDB later.
    
    It is probably 7.7 regression (I have not verified it) due to the introduction
    of Python frame filters.
    
    gdb/ChangeLog
    
    	PR python/17355
    	* python/py-framefilter.c (py_print_single_arg): Handle NULL FA->VAL.
    	Fix goto out of TRY_CATCH.
    
    gdb/testsuite/ChangeLog
    
    	PR python/17355
    	* gdb.python/amd64-py-framefilter-invalidarg.S: New file.
    	* gdb.python/py-framefilter-invalidarg-gdb.py.in: New file.
    	* gdb.python/py-framefilter-invalidarg.exp: New file.
    	* gdb.python/py-framefilter-invalidarg.py: New file.

-----------------------------------------------------------------------

Summary of changes:
 gdb/ChangeLog                                      |    6 +
 gdb/python/py-framefilter.c                        |   33 ++--
 gdb/testsuite/ChangeLog                            |    8 +
 .../gdb.python/amd64-py-framefilter-invalidarg.S   |  261 ++++++++++++++++++++
 .../gdb.python/py-framefilter-invalidarg-gdb.py.in |   48 ++++
 .../gdb.python/py-framefilter-invalidarg.exp       |   67 +++++
 .../gdb.python/py-framefilter-invalidarg.py        |   59 +++++
 7 files changed, 467 insertions(+), 15 deletions(-)
 create mode 100644 gdb/testsuite/gdb.python/amd64-py-framefilter-invalidarg.S
 create mode 100644 gdb/testsuite/gdb.python/py-framefilter-invalidarg-gdb.py.in
 create mode 100644 gdb/testsuite/gdb.python/py-framefilter-invalidarg.exp
 create mode 100644 gdb/testsuite/gdb.python/py-framefilter-invalidarg.py
Comment 3 Jan Kratochvil 2014-09-07 12:16:21 UTC
Checked in master and 7.8.
Comment 4 cvs-commit@gcc.gnu.org 2014-09-07 12:23:09 UTC
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "gdb and binutils".

The branch, gdb-7.8-branch has been updated
       via  36039ef641604d93b86688a5c8c3370b1031e28f (commit)
      from  d63942834b80b8183b3438fc18705bb361ca1725 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=36039ef641604d93b86688a5c8c3370b1031e28f

commit 36039ef641604d93b86688a5c8c3370b1031e28f
Author: Jan Kratochvil <jan.kratochvil@redhat.com>
Date:   Sun Sep 7 14:09:59 2014 +0200

    Fix crash on Python frame filters with unreadable arg
    
    https://bugzilla.redhat.com/show_bug.cgi?id=1126177
    
    ERROR: AddressSanitizer: SEGV on unknown address 0x000000000050 (pc 0x000000992bef sp 0x7ffff9039530 bp 0x7ffff9039540
    T0)
        #0 0x992bee in value_type .../gdb/value.c:925
        #1 0x87c951 in py_print_single_arg python/py-framefilter.c:445
        #2 0x87cfae in enumerate_args python/py-framefilter.c:596
        #3 0x87e0b0 in py_print_args python/py-framefilter.c:968
    
    It crashes because frame_arg::val is documented it may contain NULL
    (frame_arg::error is then non-NULL) but the code does not handle it.
    
    Another bug is that py_print_single_arg() calls goto out of its TRY_CATCH
    which messes up GDB cleanup chain crashing GDB later.
    
    It is probably 7.7 regression (I have not verified it) due to the introduction
    of Python frame filters.
    
    gdb/ChangeLog
    
    	PR python/17355
    	* python/py-framefilter.c (py_print_single_arg): Handle NULL FA->VAL.
    	Fix goto out of TRY_CATCH.
    
    gdb/testsuite/ChangeLog
    
    	PR python/17355
    	* gdb.python/amd64-py-framefilter-invalidarg.S: New file.
    	* gdb.python/py-framefilter-invalidarg-gdb.py.in: New file.
    	* gdb.python/py-framefilter-invalidarg.exp: New file.
    	* gdb.python/py-framefilter-invalidarg.py: New file.

-----------------------------------------------------------------------

Summary of changes:
 gdb/ChangeLog                                      |    6 +
 gdb/python/py-framefilter.c                        |   33 ++--
 gdb/testsuite/ChangeLog                            |    8 +
 .../gdb.python/amd64-py-framefilter-invalidarg.S   |  261 ++++++++++++++++++++
 .../gdb.python/py-framefilter-invalidarg-gdb.py.in |   48 ++++
 .../gdb.python/py-framefilter-invalidarg.exp       |   67 +++++
 .../gdb.python/py-framefilter-invalidarg.py        |   59 +++++
 7 files changed, 467 insertions(+), 15 deletions(-)
 create mode 100644 gdb/testsuite/gdb.python/amd64-py-framefilter-invalidarg.S
 create mode 100644 gdb/testsuite/gdb.python/py-framefilter-invalidarg-gdb.py.in
 create mode 100644 gdb/testsuite/gdb.python/py-framefilter-invalidarg.exp
 create mode 100644 gdb/testsuite/gdb.python/py-framefilter-invalidarg.py