mbox series

[0/3] Fix use-after-free in gdb/corelow.c + cleanups

Message ID 20230531160406.3932028-1-lancelot.six@amd.com
Headers
Series Fix use-after-free in gdb/corelow.c + cleanups |

Message

Lancelot Six May 31, 2023, 4:04 p.m. UTC 
  Hi,

Since a recent change if BFD (014a602b86f "Don't optimise bfd_seek to
same position"), I started to see ASAN report a use-after-free error
when opening some coredumps.

If the original process had some file mapped in its address space that
GDB can open, but calling bfd_check_format on this file fails, GDB would
close the BFD but keep a pointer to it for later use, leading to
use-after-free.

Such scenario can be seen when the original process had some IO pages
mapped from a DRI render node (/dev/dri/renderD$NUM) as it is the case
when offloading compute tasks to AMDGPU devices.

The first patch in this series fixes the use-after-free error.

Once this issue fixed, GDB does show a warning message once for each
region in the process address space where the special file was mapped.
This is un-necessarily noisy, and does not match what is done when GDB
does not find the file to open (exec_find_file returns null).  The
second patch of the series ensures that the warning message can only be
printed once per file.

Finally, the third patch in this series ensures that GDB does not try to
open a file if it has already failed to open it.

Since I am not sure how I can write a simple test to exercise for this
failure, I have not included one.  I have tested this series on a system
using an AMDGPU device, where I originally encountered the problem.

Lancelot SIX (3):
  gdb/corelow.c: fix use-after-free in build_file_mappings
  gdb/corelow.c: avoid repeated warnings in build_file_mappings
  gdb/corelow.c: do not try to reopen a file if open failed once

 gdb/corelow.c | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)


base-commit: a15891aaea006d06066573449efbda353dd2863e

Comments

John Baldwin May 31, 2023, 6:32 p.m. UTC | #1 
On 5/31/23 9:04 AM, Lancelot SIX via Gdb-patches wrote:
> Hi,
> 
> Since a recent change if BFD (014a602b86f "Don't optimise bfd_seek to
> same position"), I started to see ASAN report a use-after-free error
> when opening some coredumps.
> 
> If the original process had some file mapped in its address space that
> GDB can open, but calling bfd_check_format on this file fails, GDB would
> close the BFD but keep a pointer to it for later use, leading to
> use-after-free.
> 
> Such scenario can be seen when the original process had some IO pages
> mapped from a DRI render node (/dev/dri/renderD$NUM) as it is the case
> when offloading compute tasks to AMDGPU devices.
> 
> The first patch in this series fixes the use-after-free error.
> 
> Once this issue fixed, GDB does show a warning message once for each
> region in the process address space where the special file was mapped.
> This is un-necessarily noisy, and does not match what is done when GDB
> does not find the file to open (exec_find_file returns null).  The
> second patch of the series ensures that the warning message can only be
> printed once per file.
> 
> Finally, the third patch in this series ensures that GDB does not try to
> open a file if it has already failed to open it.
> 
> Since I am not sure how I can write a simple test to exercise for this
> failure, I have not included one.  I have tested this series on a system
> using an AMDGPU device, where I originally encountered the problem.
> 
> Lancelot SIX (3):
>    gdb/corelow.c: fix use-after-free in build_file_mappings
>    gdb/corelow.c: avoid repeated warnings in build_file_mappings
>    gdb/corelow.c: do not try to reopen a file if open failed once
> 
>   gdb/corelow.c | 35 ++++++++++++++++++++---------------
>   1 file changed, 20 insertions(+), 15 deletions(-)
> 
> 
> base-commit: a15891aaea006d06066573449efbda353dd2863e

Patches 2 and 3 look good to me.