From patchwork Tue Jan 23 11:48:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tom de Vries X-Patchwork-Id: 84608 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 93B52385829A for ; Tue, 23 Jan 2024 11:47:49 +0000 (GMT) X-Original-To: gdb-patches@sourceware.org Delivered-To: gdb-patches@sourceware.org Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2a07:de40:b251:101:10:150:64:1]) by sourceware.org (Postfix) with ESMTPS id 7F3F63858431 for ; Tue, 23 Jan 2024 11:47:22 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7F3F63858431 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7F3F63858431 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2a07:de40:b251:101:10:150:64:1 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1706010445; cv=none; b=Bmy9NTHcWbFNinKvBUB0Z67uUFjxuSckTXGtGcQlqW961etTjavstqHOHIx3bSU9ftA0aSkw6AXLZX5c1fcZQFhyb7Ec8mvpOi+knYVNQG2HwoKWoCwwnKstwiqLdGfrwaehEjbyVHMwNXITO+a+Oktaz/SKPqkYaSGrO6b0kMo= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1706010445; c=relaxed/simple; bh=ng1W9xGhS0893Cs9b6S595cMrgkD0yXB4PQ3+wNFSC8=; h=DKIM-Signature:DKIM-Signature:DKIM-Signature:DKIM-Signature:From: To:Subject:Date:Message-Id:MIME-Version; b=ev85ge9anqJDNPfSgmptpvRfrN3hogiUO1yWmfihcsD/++K5+BuOU8uY4JhNJUnIO6RKerQA0NAFOFZRchP6C/zGErGg7/C8v7H6R1BiJcpDIwD4EXbtSoAOrEDCbroacVHoF1z5dsnk8/oz/tYDMKFFA19UczCwswGEEBy49rA= ARC-Authentication-Results: i=1; server2.sourceware.org Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id 219F42228B; Tue, 23 Jan 2024 11:47:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1706010441; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=TVtxHn4XmtpdkckmHJMGfaNp2fkvxzYuUes35CtsC9Q=; b=KtJdLCo4TbOLk9ns795H5Ly4rVkhzs3Z3R/G4jFo5nf2If3U/eJMaPtRXuRtq3C9cki73k Ct41goQBoSrYNzStS851Jama2hmPhvqbPDfLhRsI0ZoUczoYPatOOchfIsr3MjgMkubKLO OGWGDtJDhARQsVZ7+AHrANq8GU4FhD0= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1706010441; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=TVtxHn4XmtpdkckmHJMGfaNp2fkvxzYuUes35CtsC9Q=; b=pmHRdepGQNk5S3taeKOBHB+uZ4pvABNJ7vlaEvVAcfJ8ugoOln8OiV3FR+TTxLTUdlweVF tvt/6GZcmq8EU/DQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1706010440; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=TVtxHn4XmtpdkckmHJMGfaNp2fkvxzYuUes35CtsC9Q=; b=TSlOiTF5z3OhTTygbjQuCdWn1KRT74uF+fmd9G+EBtwhNnNrg2at3gS8S+nVJuyVzCmop5 Cw1gDm7Q/S/Ir974a0PpIZGC8P4+YlREnUx8Sh1rsKkbho7NC4aSu+ziy/+AiISvmAlPDK U9ugmilObZeT0/1U2m+VZDsnH7DygUc= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1706010440; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=TVtxHn4XmtpdkckmHJMGfaNp2fkvxzYuUes35CtsC9Q=; b=4kWgRqpF2RVc11X1QKcqixLx8zHNQJn/MvQBY3W24QtPXGOnP7klV8/6ynZFP11A3Yb5q7 swyqkAi5kBsZ+CBw== Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id 06092136A4; Tue, 23 Jan 2024 11:47:20 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id TdshAEinr2WdMQAAD6G6ig (envelope-from ); Tue, 23 Jan 2024 11:47:20 +0000 From: Tom de Vries To: gdb-patches@sourceware.org Cc: Simon Marchi Subject: [PATCH v2] [gdb] Fix heap-use-after-free in select_event_lwp Date: Tue, 23 Jan 2024 12:48:30 +0100 Message-Id: <20240123114830.20253-1-tdevries@suse.de> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 X-Spam-Level: Authentication-Results: smtp-out1.suse.de; dkim=pass header.d=suse.de header.s=susede2_rsa header.b=TSlOiTF5; dkim=pass header.d=suse.de header.s=susede2_ed25519 header.b=4kWgRqpF X-Rspamd-Server: rspamd2.dmz-prg2.suse.org X-Spamd-Result: default: False [-1.51 / 50.00]; ARC_NA(0.00)[]; RCVD_VIA_SMTP_AUTH(0.00)[]; R_DKIM_ALLOW(-0.20)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; SPAMHAUS_XBL(0.00)[2a07:de40:b281:104:10:150:64:97:from]; FROM_HAS_DN(0.00)[]; TO_DN_SOME(0.00)[]; R_MISSING_CHARSET(2.50)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; MIME_GOOD(-0.10)[text/plain]; BROKEN_CONTENT_TYPE(1.50)[]; DWL_DNSWL_MED(-2.00)[suse.de:dkim]; NEURAL_HAM_LONG(-1.00)[-1.000]; RCVD_COUNT_THREE(0.00)[3]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; DKIM_TRACE(0.00)[suse.de:+]; RCPT_COUNT_TWO(0.00)[2]; MID_CONTAINS_FROM(1.00)[]; MX_GOOD(-0.01)[]; DBL_BLOCKED_OPENRESOLVER(0.00)[suse.de:dkim]; FUZZY_BLOCKED(0.00)[rspamd.com]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; NEURAL_HAM_SHORT(-0.20)[-1.000]; RCVD_TLS_ALL(0.00)[]; BAYES_HAM(-3.00)[100.00%] X-Spam-Score: -1.51 X-Rspamd-Queue-Id: 219F42228B X-Spam-Status: No, score=-12.3 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE, WEIRD_PORT autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces+patchwork=sourceware.org@sourceware.org When building gdb with -O0 -fsanitize=thread, and running test-case gdb.base/vfork-follow-parent.exp, 5 times out of 10 I run into: ... WARNING: ThreadSanitizer: heap-use-after-free (pid=249653) Write of size 4 at 0xffffee83055c by main thread: #0 select_event_lwp gdb/linux-nat.c:2809 (gdb+0xb0a65c) #1 linux_nat_wait_1 gdb/linux-nat.c:3389 (gdb+0xb0c470) #2 linux_nat_target::wait(ptid_t, target_waitstatus*, enum_flags) gdb/linux-nat.c:3560 (gdb+0xb0cfc8) #3 thread_db_target::wait(ptid_t, target_waitstatus*, enum_flags) gdb/linux-thread-db.c:1402 (gdb+0xb35958) #4 target_wait(ptid_t, target_waitstatus*, enum_flags) gdb/target.c:2571 (gdb+0xfb6c34) #5 do_target_wait_1 gdb/infrun.c:4120 (gdb+0xa99dc4) #6 operator() gdb/infrun.c:4179 (gdb+0xa99f70) #7 do_target_wait gdb/infrun.c:4198 (gdb+0xa9a2bc) #8 fetch_inferior_event() gdb/infrun.c:4629 (gdb+0xa9b658) #9 inferior_event_handler(inferior_event_type) gdb/inf-loop.c:42 (gdb+0xa6b0c8) #10 handle_target_event gdb/linux-nat.c:4357 (gdb+0xb0f694) #11 handle_file_event gdbsupport/event-loop.cc:573 (gdb+0x1cfc03c) #12 gdb_wait_for_event gdbsupport/event-loop.cc:694 (gdb+0x1cfc700) #13 gdb_do_one_event(int) gdbsupport/event-loop.cc:217 (gdb+0x1cfa8ac) #14 start_event_loop gdb/main.c:408 (gdb+0xb7be9c) #15 captured_command_loop gdb/main.c:472 (gdb+0xb7c0cc) #16 captured_main gdb/main.c:1342 (gdb+0xb7e4e4) #17 gdb_main(captured_main_args*) gdb/main.c:1361 (gdb+0xb7e594) #18 main gdb/gdb.c:39 (gdb+0x423ce8) Previous write of size 8 at 0xffffee830558 by main thread: #0 operator delete(void*, unsigned long) (libtsan.so.2+0x8fb14) #1 delete_lwp gdb/linux-nat.c:849 (gdb+0xb0384c) #2 exit_lwp gdb/linux-nat.c:924 (gdb+0xb03c4c) #3 wait_lwp gdb/linux-nat.c:2224 (gdb+0xb08404) #4 stop_wait_callback gdb/linux-nat.c:2458 (gdb+0xb092a8) #5 gdb::function_view::bind(int (*)(lwp_info*))::{lambda(gdb::fv_detail::erased_callable, lwp_info*)#1}::operator()(gdb::fv_detail::erased_callable, lwp_info*) const gdb/../gdbsupport/function-view.h:326 (gdb+0xb15ab0) #6 gdb::function_view::bind(int (*)(lwp_info*))::{lambda(gdb::fv_detail::erased_callable, lwp_info*)#1}::_FUN(gdb::fv_detail::erased_callable, lwp_info*) gdb/../gdbsupport/function-view.h:320 (gdb+0xb15b18) #7 gdb::function_view::operator()(lwp_info*) const gdb/../gdbsupport/function-view.h:289 (gdb+0xb13e90) #8 iterate_over_lwps(ptid_t, gdb::function_view) gdb/linux-nat.c:879 (gdb+0xb03a18) #9 linux_nat_wait_1 gdb/linux-nat.c:3382 (gdb+0xb0c3f8) #10 linux_nat_target::wait(ptid_t, target_waitstatus*, enum_flags) gdb/linux-nat.c:3560 (gdb+0xb0cfc8) #11 thread_db_target::wait(ptid_t, target_waitstatus*, enum_flags) gdb/linux-thread-db.c:1402 (gdb+0xb35958) #12 target_wait(ptid_t, target_waitstatus*, enum_flags) gdb/target.c:2571 (gdb+0xfb6c34) #13 do_target_wait_1 gdb/infrun.c:4120 (gdb+0xa99dc4) #14 operator() gdb/infrun.c:4179 (gdb+0xa99f70) #15 do_target_wait gdb/infrun.c:4198 (gdb+0xa9a2bc) #16 fetch_inferior_event() gdb/infrun.c:4629 (gdb+0xa9b658) #17 inferior_event_handler(inferior_event_type) gdb/inf-loop.c:42 (gdb+0xa6b0c8) #18 handle_target_event gdb/linux-nat.c:4357 (gdb+0xb0f694) #19 handle_file_event gdbsupport/event-loop.cc:573 (gdb+0x1cfc03c) #20 gdb_wait_for_event gdbsupport/event-loop.cc:694 (gdb+0x1cfc700) #21 gdb_do_one_event(int) gdbsupport/event-loop.cc:217 (gdb+0x1cfa8ac) #22 start_event_loop gdb/main.c:408 (gdb+0xb7be9c) #23 captured_command_loop gdb/main.c:472 (gdb+0xb7c0cc) #24 captured_main gdb/main.c:1342 (gdb+0xb7e4e4) #25 gdb_main(captured_main_args*) gdb/main.c:1361 (gdb+0xb7e594) #26 main gdb/gdb.c:39 (gdb+0x423ce8) SUMMARY: ThreadSanitizer: heap-use-after-free gdb/linux-nat.c:2809 in select_event_lwp ... Since heap-use-after-free is essentially an address sanitizer complaint, I also tried building gdb with -O0 -fsanitize=address, but with this setup it doesn't seem to trigger (0 times out of 10). The heap-use-after-free happens during the following scenario: - linux_nat_wait_1 selects an LWP thread T1 with a status to report. - it sets variable lp to point to the corresponding lwp_info. - it calls stop_callback and stop_wait_callback for all threads (because !target_is_non_stop_p ()). - it calls select_event_lwp to maybe pick another thread than T1, to prevent starvation. The problem seems to be the following: - while calling stop_wait_callback for all threads, it also does this for T1. While doing so, the corresponding lwp_info is deleted (callstack stop_wait_callback -> wait_lwp -> exit_lwp -> delete_lwp), leaving variable lp as a dangling pointer. - variable lp is passed to select_event_lwp, which derefences it, which causes the heap-use-after-free. Note that the comment here mentions "all other LWP's": ... /* Now stop all other LWP's ... */ iterate_over_lwps (minus_one_ptid, stop_callback); /* ... and wait until all of them have reported back that they're no longer running. */ iterate_over_lwps (minus_one_ptid, stop_wait_callback); ... which presumably means other than the one in lp, but the iterators don't skip lp. Fix this by making the code match the comment, and skipping stop_callback and stop_wait_callback for lp. Tested on aarch64-linux. PR gdb/31259 Bug: https://sourceware.org/bugzilla/show_bug.cgi?id=31259 Reviewed-By: Simon Marchi --- gdb/linux-nat.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) base-commit: 047fa8cc1cc534f19428b18d3d0c50e8139d3335 diff --git a/gdb/linux-nat.c b/gdb/linux-nat.c index e91c57ba239..8bfae8555fc 100644 --- a/gdb/linux-nat.c +++ b/gdb/linux-nat.c @@ -3375,11 +3375,23 @@ linux_nat_wait_1 (ptid_t ptid, struct target_waitstatus *ourstatus, if (!target_is_non_stop_p ()) { /* Now stop all other LWP's ... */ - iterate_over_lwps (minus_one_ptid, stop_callback); + for (lwp_info *other_lp : all_lwps_safe ()) + { + if (other_lp == lp) + continue; + + stop_callback (other_lp); + } /* ... and wait until all of them have reported back that they're no longer running. */ - iterate_over_lwps (minus_one_ptid, stop_wait_callback); + for (lwp_info *other_lp : all_lwps_safe ()) + { + if (other_lp == lp) + continue; + + stop_wait_callback (other_lp); + } } /* If we're not waiting for a specific LWP, choose an event LWP from