diff options
author | Jan Kratochvil <jan.kratochvil@redhat.com> | 2015-05-19 16:12:30 +0200 |
---|---|---|
committer | Jan Kratochvil <jan.kratochvil@redhat.com> | 2015-05-19 16:12:30 +0200 |
commit | 5fe75eec33c0f55536f09b2f3d692fb688a2c423 (patch) | |
tree | 295c7060f413b22dbf89cd53df02e1b4531fb6e1 /gdb | |
parent | a40635885c50f14782d80251a8966bf4dd271f76 (diff) | |
download | gdb-5fe75eec33c0f55536f09b2f3d692fb688a2c423.zip gdb-5fe75eec33c0f55536f09b2f3d692fb688a2c423.tar.gz gdb-5fe75eec33c0f55536f09b2f3d692fb688a2c423.tar.bz2 |
compile: Fix ASAN crash for gdb.compile/compile.exp
(gdb) PASS: gdb.compile/compile.exp: set unwindonsignal on
compile code *(volatile int *) 0 = 0;
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7fba426 in _gdb_expr (__regs=0x7ffff7fb8000) at gdb command line:1
1 gdb command line: No such file or directory.
=================================================================
==10462==ERROR: AddressSanitizer: heap-use-after-free on address 0x621000cf7a3d at pc 0x0000004e46b9 bp 0x7ffdeb0f7a40 sp 0x7ffdeb0f71b8
READ of size 10 at 0x621000cf7a3d thread T0
#0 0x4e46b8 in printf_common(void*, char const*, __va_list_tag*) [clone .isra.6] (/home/jkratoch/redhat/gdb-clean-asan/gdb/gdb+0x4e46
b8)
#1 0x4f645e in vasprintf (/home/jkratoch/redhat/gdb-clean-asan/gdb/gdb+0x4f645e)
#2 0xe5cf00 in xstrvprintf common/common-utils.c:120
#3 0xe74192 in throw_it common/common-exceptions.c:332
#4 0xe742f6 in throw_verror common/common-exceptions.c:361
#5 0xddc89e in verror /home/jkratoch/redhat/gdb-clean-asan/gdb/utils.c:541
#6 0xe734bd in error common/errors.c:43
#7 0xafa1d6 in call_function_by_hand_dummy /home/jkratoch/redhat/gdb-clean-asan/gdb/infcall.c:1031
#8 0xe81858 in compile_object_run compile/compile-object-run.c:119
#9 0xe7733c in eval_compile_command compile/compile.c:577
#10 0xe7541e in compile_code_command compile/compile.c:153
It is obvious why that happens, dummy_frame_pop() will call compile objfile
cleanup which will free that objfile and NAME then becomes a stale pointer.
> Is there any reason we release OBJFILE in the dummy frame dtor? Why
> don't we register a cleanup to release in OBJFILE in compile_object_run?
> together with releasing compile_module? 'struct compile_module' has a
> field objfile, which should be released together with
> 'struct compile_module' instead of dummy_frame.
(gdb) break puts
Breakpoint 2 at 0x3830c6fd30: file ioputs.c, line 34.
(gdb) compile code puts("hello")
Breakpoint 2, _IO_puts (str=0x7ffff7ff8000 "hello") at ioputs.c:34
34 {
The program being debugged stopped while in a function called from GDB.
Evaluation of the expression containing the function
(_gdb_expr) will be abandoned.
When the function is done executing, GDB will silently stop.
(gdb) bt
(gdb) _
Now compile_object_run() called from line
(gdb) compile code puts("hello")
has finished for a long time. But we still need to have that injected code
OBJFILE valid when GDB is executing it. Therefore OBJFILE is freed only from
destructor of the frame #1.
At the patched line of call_function_by_hand_dummy() the dummy frame
destructor has not yet been run but it will be run before the fetched NAME
will get used.
gdb/ChangeLog
2015-05-19 Jan Kratochvil <jan.kratochvil@redhat.com>
Fix ASAN crash for gdb.compile/compile.exp.
* infcall.c (call_function_by_hand_dummy): Use xstrdup for NAME.
Diffstat (limited to 'gdb')
-rw-r--r-- | gdb/ChangeLog | 5 | ||||
-rw-r--r-- | gdb/infcall.c | 7 |
2 files changed, 10 insertions, 2 deletions
diff --git a/gdb/ChangeLog b/gdb/ChangeLog index 8fbc023..6d7a7cf 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,5 +1,10 @@ 2015-05-19 Jan Kratochvil <jan.kratochvil@redhat.com> + Fix ASAN crash for gdb.compile/compile.exp. + * infcall.c (call_function_by_hand_dummy): Use xstrdup for NAME. + +2015-05-19 Jan Kratochvil <jan.kratochvil@redhat.com> + * compile/compile-c-symbols.c (convert_symbol_sym, gcc_convert_symbol) (gcc_symbol_address): Change gdb_stdout to gdb_stdlog. * compile/compile-object-load.c (setup_sections, compile_object_load): diff --git a/gdb/infcall.c b/gdb/infcall.c index 5dd908d..f79afea 100644 --- a/gdb/infcall.c +++ b/gdb/infcall.c @@ -1104,8 +1104,11 @@ When the function is done executing, GDB will silently stop."), if (stopped_by_random_signal || stop_stack_dummy != STOP_STACK_DUMMY) { - const char *name = get_function_name (funaddr, - name_buf, sizeof (name_buf)); + /* Make a copy as NAME may be in an objfile freed by dummy_frame_pop. */ + char *name = xstrdup (get_function_name (funaddr, + name_buf, sizeof (name_buf))); + make_cleanup (xfree, name); + if (stopped_by_random_signal) { |