From patchwork Thu Jun 1 10:45:40 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lancelot SIX X-Patchwork-Id: 70444 Return-Path: X-Original-To: patchwork@sourceware.org Delivered-To: patchwork@sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 54CB7385703F for ; Thu, 1 Jun 2023 10:47:33 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 54CB7385703F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1685616453; bh=MrNCD+TLEXzRfxfFDUQW5W+Qj66S1KBfuInbzo7dizw=; h=To:CC:Subject:Date:In-Reply-To:References:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=cw61D7Dr+nEPlelLCCsmXszTI2n1DX90JVg1Qky6qbx3IO99hIcxH1RDL1t4qOVPW UiKTjOpPKse7gVRnZIT4tStd5Hthf0ShgWQHUjfPrf541UfEUXhvilaDmgS1tZRYkO 7NfZ//VnPx67quZ/7KYPOLbRlzWv+2PKX3q6Buzo= X-Original-To: gdb-patches@sourceware.org Delivered-To: gdb-patches@sourceware.org Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2045.outbound.protection.outlook.com [40.107.93.45]) by sourceware.org (Postfix) with ESMTPS id 40CEB3858C41 for ; Thu, 1 Jun 2023 10:47:09 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 40CEB3858C41 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=DwuKfHshIacMpxcqL70Bkfii+5zDXEoLZzi9tewo7i1h8up6w+U1ZwNWGd+ipx73nf2+jsNGtwbwqk/1cQGuvf7wjJt51lI9EJ9UgKbGKkN9j4GISwwv+48Y+AvpXJhY0wodvYQdUBrwzK7YJHwELITXkLFy4HEFl/gsSAi0i9HXfcR7X+rg9KyTlzgRnWV2PKg1rg3CLTHjGmPiuismUhegfEnw3D+KhMvClI9/4y1Q/l2Mxoy2/SCuY8BmPTKTQBY+O45CIjPK9ya7nNqXdFwThwENLOwW2rPDlAPkXVshmK/sFJTIl3HvGYw8OPUQLBtyYUmhhtLpE4NwrUnOug== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MrNCD+TLEXzRfxfFDUQW5W+Qj66S1KBfuInbzo7dizw=; b=ii6wegs4kMrt1pMETQfXIE1aoWXgyt52a/fTnVWo0Af+ZFJ2IdkbmVH7B/HiLBNSgdhyMo4iVcaBCgAB7LY1TIY1lWMJBl+E0lNJsr61HZWspfewyiyeHE7PNIz+W6QWLlqX/nvFSJFDokVLFZGQplgMIieM4MgPpLZTcmTWonsmpIlOphxJx/Z2xj/g9Nf35PxceICVih+6z4vLdGwWk1ZR6cthsat/5GD3fm7C+y4Q0UxqdtSNZmNo8IptY2vJ3lkPd4H9ihZOJlGfVptUWEpQMDuTJBQXxqOL6h/7TDd0wXmxKmWwOTQvShu9bomU60tOayA5pRptRYJJDoOyug== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=redhat.com smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none Received: from DM6PR21CA0013.namprd21.prod.outlook.com (2603:10b6:5:174::23) by CH0PR12MB8529.namprd12.prod.outlook.com (2603:10b6:610:18d::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6455.23; Thu, 1 Jun 2023 10:47:06 +0000 Received: from DM6NAM11FT061.eop-nam11.prod.protection.outlook.com (2603:10b6:5:174:cafe::86) by DM6PR21CA0013.outlook.office365.com (2603:10b6:5:174::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6477.9 via Frontend Transport; Thu, 1 Jun 2023 10:47:06 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 165.204.84.17) smtp.mailfrom=amd.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=amd.com; Received-SPF: Pass (protection.outlook.com: domain of amd.com designates 165.204.84.17 as permitted sender) receiver=protection.outlook.com; client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C Received: from SATLEXMB04.amd.com (165.204.84.17) by DM6NAM11FT061.mail.protection.outlook.com (10.13.173.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.20.6455.23 via Frontend Transport; Thu, 1 Jun 2023 10:47:06 +0000 Received: from khazad-dum.amd.com (10.180.168.240) by SATLEXMB04.amd.com (10.181.40.145) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Thu, 1 Jun 2023 05:47:04 -0500 To: , CC: , , Subject: [PATCH v2 1/3] gdb/corelow.c: fix use-after-free in build_file_mappings Date: Thu, 1 Jun 2023 11:45:40 +0100 Message-ID: <20230601104540.156137-1-lancelot.six@amd.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <87ttvr4i9z.fsf@redhat.com> References: <87ttvr4i9z.fsf@redhat.com> MIME-Version: 1.0 X-Originating-IP: [10.180.168.240] X-ClientProxiedBy: SATLEXMB03.amd.com (10.181.40.144) To SATLEXMB04.amd.com (10.181.40.145) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DM6NAM11FT061:EE_|CH0PR12MB8529:EE_ X-MS-Office365-Filtering-Correlation-Id: 628c32fc-1480-4c9b-5d8c-08db628d8b03 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: zpdR3ckXKJW13xG+2x8saJ7T9WNIViw8k1N9LvShU0XfBUW9oNUcwvjkXhA42sGvFWXA0HA3hSwTD08RJSyvdB98sSWzXGNarFOcMlRxxRkXcYC23oBS3akwxv0wOVD/BCld0D14Dm5s1XUdz8NisjDXRjErleWtlxHrnf3cgduY0/9OyDJXRvV6ypgZTau7fddnO+L5PXCobkYxzmnwden4Iu0CWMD8w7ILsCwRBQiee+goug1Hx3nA/gI0bNKbQZ0pYwJkWyrZODDnprWYcHfOQ0nUC6KppFSz/LYkPQoO7OKBMJSwGdsKTtPC+u+dO4jwC3JoQdG/XRHmB2KxOULuNxRr/qr/GCOmxPy4NK/M+AkKC4HuPK3QQMPHNy8JeYUcht8BzhEFEqCyQ/D3/Go+xIP9a1g4SH/xzEXreS0tLDbIwDGf0H4DowTZE480MYPnkRczJUQUwRTmOkHXi+AJFJ1M+VpR8YBrq1njM15jLxGjJytTmPNttmiXWgOtxznw00HdksLRE3/ehFMFms8BE6cZ5eHjaoLAbvKPestKjEEkxaikVHzX7bYJvnnepRGCow+WmZMfaQ7NSdWH+AyoN9CNvEtKKWfi6/9ewx0H2eccEElcpHfooaSohQc9ygl7XDFiBRX6Zu7yk4TZpHgPZXC00nyziA745tB8cZNz9jlm+roou2ViQ0LZ0068gjCGkR1g1GIuP7gm11eTRtgqyOPer1/M1DcxQwGZIS90OTFp51MwzG9AJlwjcVW5iBTFaCSI8M80AOJCK5kHrA== X-Forefront-Antispam-Report: CIP:165.204.84.17; CTRY:US; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:SATLEXMB04.amd.com; PTR:InfoDomainNonexistent; CAT:NONE; SFS:(13230028)(4636009)(39860400002)(346002)(376002)(136003)(396003)(451199021)(46966006)(36840700001)(40470700004)(82740400003)(81166007)(36756003)(356005)(86362001)(82310400005)(40460700003)(8936002)(8676002)(41300700001)(5660300002)(26005)(1076003)(40480700001)(2906002)(186003)(16526019)(336012)(426003)(47076005)(83380400001)(2616005)(6666004)(316002)(7696005)(70206006)(70586007)(110136005)(54906003)(478600001)(36860700001)(4326008)(36900700001); DIR:OUT; SFP:1101; X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Jun 2023 10:47:06.4284 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 628c32fc-1480-4c9b-5d8c-08db628d8b03 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXMB04.amd.com] X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT061.eop-nam11.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH0PR12MB8529 X-Spam-Status: No, score=-11.5 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FORGED_SPF_HELO, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2, SPF_HELO_PASS, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Lancelot SIX via Gdb-patches From: Lancelot SIX Reply-To: Lancelot SIX Errors-To: gdb-patches-bounces+patchwork=sourceware.org@sourceware.org Sender: "Gdb-patches" Hi, Thanks John and Andrew for the reviews and suggestions. Here is a V2 for patch #1 (I have added Andrew's Reviewed-By tag to patch 2 and 3). John, should I add your Reviewed-By tag in patches 2 and 3 as you reviewed them as well? Changes since V1: - Only register the bfd in bfd_map if it got successfully opened, following John's suggestion. I have not used the exact pattern suggested in the review to avoid duplicating the warning message. Best, Lancelot. Reviewed-By: John Baldwin --- In core_target::build_file_mappings, GDB tries to open files referenced in the core dump. The process goes like this: struct bfd *bfd = bfd_map[filename]; if (bfd == nullptr) { bfd = bfd_map[filename] = bfd_openr (expanded_fname.get (), "binary"); if (bfd == nullptr || !bfd_check_format (bfd, bfd_object)) { if (bfd != nullptr) bfd_close (bfd); return; } } asection *sec = bfd_make_section_anyway (bfd, "load"); ... The problem is that if bfd_check_format fails, we close the bfd but keep a reference to it in the bfd_map. If the same filename appears another time in the NT_FILE note, we enter this code again. The second time, bfd_map[filename] is not nullptr and we try to call bfd_make_section_anyway on an already closed BFD, which is a use-after-free error. This patch makes sure that the bfd is only saved in the bfd_map if it got opened successfully. This error got exposed by a recent change in BFD (014a602b86f "Don't optimise bfd_seek to same position"). Since this change, opening a coredump which contains mapping to some special files such as a DRI render node (/dev/dri/renderD$NUM) exposes the issue. This happens for example for processes using AMDGPU devices to offload compute tasks. --- gdb/corelow.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gdb/corelow.c b/gdb/corelow.c index db489b4280e..54def4198bc 100644 --- a/gdb/corelow.c +++ b/gdb/corelow.c @@ -258,8 +258,7 @@ core_target::build_file_mappings () return; } - bfd = bfd_map[filename] = bfd_openr (expanded_fname.get (), - "binary"); + bfd = bfd_openr (expanded_fname.get (), "binary"); if (bfd == nullptr || !bfd_check_format (bfd, bfd_object)) { @@ -284,6 +283,7 @@ core_target::build_file_mappings () This can be checked before/after a core file detach via "maint info bfds". */ gdb_bfd_record_inclusion (core_bfd, bfd); + bfd_map[filename] = bfd; } /* Make new BFD section. All sections have the same name,