Skip to content

Commit 5fe75ee

Browse files
committed
compile: Fix ASAN crash for gdb.compile/compile.exp
(gdb) PASS: gdb.compile/compile.exp: set unwindonsignal on compile code *(volatile int *) 0 = 0; Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7fba426 in _gdb_expr (__regs=0x7ffff7fb8000) at gdb command line:1 1 gdb command line: No such file or directory. ================================================================= ==10462==ERROR: AddressSanitizer: heap-use-after-free on address 0x621000cf7a3d at pc 0x0000004e46b9 bp 0x7ffdeb0f7a40 sp 0x7ffdeb0f71b8 READ of size 10 at 0x621000cf7a3d thread T0 #0 0x4e46b8 in printf_common(void*, char const*, __va_list_tag*) [clone .isra.6] (/home/jkratoch/redhat/gdb-clean-asan/gdb/gdb+0x4e46 b8) #1 0x4f645e in vasprintf (/home/jkratoch/redhat/gdb-clean-asan/gdb/gdb+0x4f645e) #2 0xe5cf00 in xstrvprintf common/common-utils.c:120 #3 0xe74192 in throw_it common/common-exceptions.c:332 #4 0xe742f6 in throw_verror common/common-exceptions.c:361 #5 0xddc89e in verror /home/jkratoch/redhat/gdb-clean-asan/gdb/utils.c:541 #6 0xe734bd in error common/errors.c:43 #7 0xafa1d6 in call_function_by_hand_dummy /home/jkratoch/redhat/gdb-clean-asan/gdb/infcall.c:1031 #8 0xe81858 in compile_object_run compile/compile-object-run.c:119 #9 0xe7733c in eval_compile_command compile/compile.c:577 #10 0xe7541e in compile_code_command compile/compile.c:153 It is obvious why that happens, dummy_frame_pop() will call compile objfile cleanup which will free that objfile and NAME then becomes a stale pointer. > Is there any reason we release OBJFILE in the dummy frame dtor? Why > don't we register a cleanup to release in OBJFILE in compile_object_run? > together with releasing compile_module? 'struct compile_module' has a > field objfile, which should be released together with > 'struct compile_module' instead of dummy_frame. (gdb) break puts Breakpoint 2 at 0x3830c6fd30: file ioputs.c, line 34. (gdb) compile code puts("hello") Breakpoint 2, _IO_puts (str=0x7ffff7ff8000 "hello") at ioputs.c:34 34 { The program being debugged stopped while in a function called from GDB. Evaluation of the expression containing the function (_gdb_expr) will be abandoned. When the function is done executing, GDB will silently stop. (gdb) bt (gdb) _ Now compile_object_run() called from line (gdb) compile code puts("hello") has finished for a long time. But we still need to have that injected code OBJFILE valid when GDB is executing it. Therefore OBJFILE is freed only from destructor of the frame #1. At the patched line of call_function_by_hand_dummy() the dummy frame destructor has not yet been run but it will be run before the fetched NAME will get used. gdb/ChangeLog 2015-05-19 Jan Kratochvil <[email protected]> Fix ASAN crash for gdb.compile/compile.exp. * infcall.c (call_function_by_hand_dummy): Use xstrdup for NAME.
1 parent a406358 commit 5fe75ee

File tree

2 files changed

+10
-2
lines changed

2 files changed

+10
-2
lines changed

gdb/ChangeLog

+5
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
2015-05-19 Jan Kratochvil <[email protected]>
2+
3+
Fix ASAN crash for gdb.compile/compile.exp.
4+
* infcall.c (call_function_by_hand_dummy): Use xstrdup for NAME.
5+
16
2015-05-19 Jan Kratochvil <[email protected]>
27

38
* compile/compile-c-symbols.c (convert_symbol_sym, gcc_convert_symbol)

gdb/infcall.c

+5-2
Original file line numberDiff line numberDiff line change
@@ -1104,8 +1104,11 @@ When the function is done executing, GDB will silently stop."),
11041104

11051105
if (stopped_by_random_signal || stop_stack_dummy != STOP_STACK_DUMMY)
11061106
{
1107-
const char *name = get_function_name (funaddr,
1108-
name_buf, sizeof (name_buf));
1107+
/* Make a copy as NAME may be in an objfile freed by dummy_frame_pop. */
1108+
char *name = xstrdup (get_function_name (funaddr,
1109+
name_buf, sizeof (name_buf)));
1110+
make_cleanup (xfree, name);
1111+
11091112

11101113
if (stopped_by_random_signal)
11111114
{

0 commit comments

Comments
 (0)