From patchwork Tue Aug 16 19:14:31 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Keef Aragon X-Patchwork-Id: 56794 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 20A98385829F for ; Tue, 16 Aug 2022 19:15:01 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) by sourceware.org (Postfix) with ESMTPS id 02C6C3858CDA for ; Tue, 16 Aug 2022 19:14:44 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org 02C6C3858CDA Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=konscious.net Authentication-Results: sourceware.org; spf=none smtp.mailfrom=konscious.net Received: by mail-pl1-x62f.google.com with SMTP id 20so1460280plo.10 for ; Tue, 16 Aug 2022 12:14:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konscious-net.20210112.gappssmtp.com; s=20210112; h=to:subject:message-id:date:from:mime-version:from:to:cc; bh=yoqsqNBImMepbpJGyYEXfRY/SQkMqfKkzeCtmAwXURk=; b=qkJaVXpTfWsaEX+V8SoBMC1SGoACnMj+efJ2Feu6zNNCNtzVliwKLDHPxjd90u1c2K gGfh8xfDbOOL7tMdXarCKvjiiT9+XeeRFlwKU/HqSLiw4k4AzCYy0t+9bmgGMcxEFNdV 3uHeuxfMkbbyZVm8ZAK2yINIDOwh7t27Xyrv1auu2sDDxKn6yR71MrjSKiE0RmNRZy6s NRP6JN2aO/Vhm4zNZcR1rIw4po2B4Z/L6OWOuPD5BCz2ue7xASrhB99Kji/sIZZphWot UvdPmKWTT03zG/yLXlyAuFfBPCtirDqUZi6CmFcjydU6tw88a1gTrjYo/1uSq6T6zerc Uh3A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc; bh=yoqsqNBImMepbpJGyYEXfRY/SQkMqfKkzeCtmAwXURk=; b=vn1FQZywFut8raz9PGhNdenZ6M8d7mKeFUZTUvkAhHgSk9swSPOD4Q5MgClm8g/90p ngb2McFa7joiMRrq3U6iHP5YmTqYTZvGhzLTxVFxrppP/xxnsOXhynqzwK+SNh2E4O4R Srxs7SD5pIxIHYrSsMA+dXrV7/LguQM+Z4i4Y/TN4UnVGnMJkJqsnoQzJwjjJ0JaZw06 NN1Ohn0fhL7U7YW+k0PQwXIcUmNiJPo3mQ1YTAtiuBd5NqckuzZeQkq1CPuY+IXOJAkB Jn1ap9DEQEzImJXPEVPM8bosXpr+G9btzeBjhfzV6TtK8KtTfRCM9t+IUFjanS+oXakO Onow== X-Gm-Message-State: ACgBeo111/9fitixCpv0etEIYmLQ0t1cbJXtCChYrqy4Ujkxi6E3NTTX 3k2bKMtz4oOJx3PYSKMLby/E99e2LvWwTs1CGLRVlYDJtMovwdY= X-Google-Smtp-Source: AA6agR4x+X+lPxllECLHVdHbNytcIJuLdWLhcvTOyecOySY+gAlfjf0sytF7GET5DL1cgU67FiweM8K/TCOHmmKHck0= X-Received: by 2002:a17:90a:b794:b0:1f4:feec:2910 with SMTP id m20-20020a17090ab79400b001f4feec2910mr34393pjr.214.1660677282809; Tue, 16 Aug 2022 12:14:42 -0700 (PDT) MIME-Version: 1.0 From: Keef Aragon Date: Tue, 16 Aug 2022 12:14:31 -0700 Message-ID: Subject: [PATCH] bug in emergency cxa pool free() To: libstdc++@gcc.gnu.org, gcc-patches@gcc.gnu.org X-Spam-Status: No, score=-11.5 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, GIT_PATCH_0, HTML_MESSAGE, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-Content-Filtered-By: Mailman/MimeDel 2.1.29 X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gcc-patches-bounces+patchwork=sourceware.org@gcc.gnu.org Sender: "Gcc-patches" This probably has never actually affected anyone in practice. The normal ABI implementation just uses malloc and only falls back to the pool on malloc failure. But if that happens a bunch of times the freelist gets out of order which violates some of the invariants of the freelist (as well as the comments that follow the bug). The bug is just a comparison reversal when traversing the freelist in the case where the pointer being returned to the pool is after the existing freelist. I'm not sure what to do as far as the test suite is concerned. It's a private part of the implementation of the exception handling ABI and it can only ever be triggered if malloc fails (repeatedly). So it seems like reproducing it from the external interface will require hooking malloc to forcibly return NULL. But I'm a newb on these lists, so will obediently do as instructed. diff --git a/libstdc++-v3/ChangeLog-2022 b/libstdc++-v3/ChangeLog-2022 new file mode 100644 index 00000000000..8057de58539 --- /dev/null +++ b/libstdc++-v3/ChangeLog-2022 @@ -0,0 +1,4 @@ +2022-08-16 Keef Aragon + + * libstdc++-v3/libsupc++/eh_alloc.cc: inverse comparison in pool::free + diff --git a/libstdc++-v3/libsupc++/eh_alloc.cc b/libstdc++-v3/libsupc++/eh_alloc.cc index c85b9aed40b..cad2750e3b9 100644 --- a/libstdc++-v3/libsupc++/eh_alloc.cc +++ b/libstdc++-v3/libsupc++/eh_alloc.cc @@ -225,7 +225,7 @@ namespace for (fe = &first_free_entry; (*fe)->next && (reinterpret_cast ((*fe)->next) - > reinterpret_cast (e) + sz); + < reinterpret_cast (e) + sz); fe = &(*fe)->next) ; // If we can merge the next block into us do so and continue