[Bug symtab/31694] heap-use-after-free in index-cache

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=31694

--- Comment #4 from Sourceware Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Hannes Domani <ssbssa@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=5140d8e013b0d8ab560b1bb8c72e0a8b2e96ac4b

commit 5140d8e013b0d8ab560b1bb8c72e0a8b2e96ac4b
Author: Hannes Domani <ssbssa@yahoo.de>
Date:   Sat May 4 18:55:20 2024 +0200

    Fix heap-use-after-free in index-cached with --disable-threading

    If threads are disabled, either by --disable-threading explicitely, or by
    missing std::thread support, you get the following ASAN error when
    loading symbols:

    ==7310==ERROR: AddressSanitizer: heap-use-after-free on address
0x614000002128 at pc 0x00000098794a bp 0x7ffe37e6af70 sp 0x7ffe37e6af68
    READ of size 1 at 0x614000002128 thread T0
        #0 0x987949 in index_cache_store_context::store() const
../../gdb/dwarf2/index-cache.c:163
        #1 0x943467 in cooked_index_worker::write_to_cache(cooked_index const*,
deferred_warnings*) const ../../gdb/dwarf2/cooked-index.c:601
        #2 0x1705e39 in std::function<void ()>::operator()() const
/gcc/9/include/c++/9.2.0/bits/std_function.h:690
        #3 0x1705e39 in gdb::task_group::impl::~impl()
../../gdbsupport/task-group.cc:38

    0x614000002128 is located 232 bytes inside of 408-byte region
[0x614000002040,0x6140000021d8)
    freed by thread T0 here:
        #0 0x7fd75ccf8ea5 in operator delete(void*, unsigned long)
../../.././libsanitizer/asan/asan_new_delete.cc:177
        #1 0x9462e5 in cooked_index::index_for_writing()
../../gdb/dwarf2/cooked-index.h:689
        #2 0x9462e5 in operator() ../../gdb/dwarf2/cooked-index.c:657
        #3 0x9462e5 in _M_invoke
/gcc/9/include/c++/9.2.0/bits/std_function.h:300

    It's happening because cooked_index_worker::wait always returns true in
    this case, which tells cooked_index::wait it can delete the m_state
    cooked_index_worker member, but cooked_index_worker::write_to_cache tries
    to access it immediately afterwards.

    Fixed by making cooked_index_worker::wait only return true if desired_state
    is CACHE_DONE, same as if threading was enabled, so m_state will not be
    prematurely deleted.

    Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31694
    Approved-By: Tom Tromey <tom@tromey.com>

-- 
You are receiving this mail because:
You are on the CC list for the bug.