[RFC][PATCH] Fix AIX core file handling: prevent crashes during GDB quit
Aditya Vidyadhar Kamath
akamath996@gmail.com
Tue Mar 24 14:38:36 GMT 2026
From: Aditya Vidyadhar Kamath <aditya.kamath1@ibm.com>
When quitting GDB after analyzing a core file, _bfd_coff_free_cached_info()
crashed with a segmentation fault.
We can see this problem when quit after debugging a large core file
in AIX 7.3.
Ex:
Program terminated with signal SIGSEGV, Segmentation fault.
from /opt/freeware/lib/libpython3.9.a(libpython3.9.so)
(gdb)q
Fatal signal: Segmentation fault
----- Backtrace -----
0x1009fbffb ???
0x1009fc11f ???
0x1005c3587 ???
0x1005c3833 ???
0x4fdf ???
The backtrace showed:
htab_delete(0x0000bc18) at 0x1000e2e4
_bfd_coff_free_cached_info(abfd = 0x20023a90) at 0xd02e5a58
bfd_cache_close(abfd = 0x20023a90) at 0xd02c0e7c
bfd_cache_close_all() at 0xd02c0f48
bfd_close_all_done(abfd = 0x20023a90) at 0xd02c1234
bfd_close(abfd = 0x20023a90) at 0xd02c1180
My understanding so is as follows:
1. AIX core files store a pointer to 'struct core_dumpxx' in abfd->tdata.any
2. COFF object files store a pointer to 'struct coff_data_type' in the same field
3. The condition checked: (bfd_get_format(abfd) == bfd_object ||
bfd_get_format(abfd) == bfd_core)
4. For core files, the code cast 'core_dumpxx *' to 'coff_data_type *'
5. It then tried to read 'section_by_target_index' hash table pointer
6. Reading from the wrong offset in core_dumpxx returned garbage (0xbc18)
7. This garbage pointer passed the NULL check but crashed in htab_delete()
I think the hash tables are only allocated when processing COFF symbols, which
never happens for core files.
This patch is a fix to the same.
---
bfd/coffgen.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/bfd/coffgen.c b/bfd/coffgen.c
index 030dbc1dc79..ca555647592 100644
--- a/bfd/coffgen.c
+++ b/bfd/coffgen.c
@@ -3310,8 +3310,7 @@ _bfd_coff_free_cached_info (bfd *abfd)
struct coff_tdata *tdata;
if (bfd_family_coff (abfd)
- && (bfd_get_format (abfd) == bfd_object
- || bfd_get_format (abfd) == bfd_core)
+ && (bfd_get_format (abfd) == bfd_object)
&& (tdata = coff_data (abfd)) != NULL)
{
if (tdata->section_by_index)
--
2.41.0
More information about the Binutils
mailing list