From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id YIrJEe6oUWeZ3gQAWB0awg (envelope-from ) for ; Thu, 05 Dec 2024 08:21:50 -0500 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=BuTW2Byi; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 3E9EC1E197; Thu, 5 Dec 2024 08:21:50 -0500 (EST) X-Spam-Checker-Version: SpamAssassin 4.0.0 (2022-12-13) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-6.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=unavailable autolearn_force=no version=4.0.0 Received: from server2.sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id E951F1E092 for ; Thu, 5 Dec 2024 08:21:49 -0500 (EST) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 7C93A3858404 for ; Thu, 5 Dec 2024 13:21:49 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 7C93A3858404 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=BuTW2Byi Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by sourceware.org (Postfix) with ESMTP id 1BC603858C50 for ; Thu, 5 Dec 2024 13:20:12 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 1BC603858C50 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=redhat.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 1BC603858C50 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1733404812; cv=none; b=Ci1NP3dy3WKvP4sfGYjSHcubbFP/fDJFL59NynK/t+fD0PoRZsB531hahE9oDNb7wjAHVJFeUkztVtPmC9jMmV/AK0AiliQ4U0Eh/Rzfyg8+csJUaTsI7LKqLa8QmcOezt/Ool9e8Es0ypDS/u8Irco61mC7T2fjpjSd1NIDeHs= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1733404812; c=relaxed/simple; bh=nH3f9R+4bVsmCrbmp4YJEzwXt6TXug6IMgEmE+CSHdI=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=hX+QnpiUCgFPT3VKN/OQ0Wivz/6d7ZbdV4AuyZzKEONydVGeSJEiGkeN/QwfFt02/ptilBFghWcs/dLqXbUJPBgcrduiwtg4e0V6lStnU6w7cKI7rgDrgq7Pf0eLp4W8RaAo0jkyarweOl39E27oJ1y8x4QYZ09LfpawKVBOmIo= ARC-Authentication-Results: i=1; server2.sourceware.org DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 1BC603858C50 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1733404811; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=3Kq09KVFwTY8nfapO440UTOH5FvMDlcsb5Z/PwFR4HI=; b=BuTW2ByiS7T+tYb+r/brzbuP9iuMDtQg10wlNAZ1r+XXfP0P1qEtsehedmi7oNqep9goB6 mCIj9EDyF+URuK8JMZ0k+m7q0lvnTlRy5GVRmnLQtY0/mj2NvwsWvj0Y59i3PTUVqecMa2 oceAmanwCMs6QUmbhV0pDoJymyyXBx8= Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-693-BeNeGRTvM7yzvH2NTzYWhg-1; Thu, 05 Dec 2024 08:20:10 -0500 X-MC-Unique: BeNeGRTvM7yzvH2NTzYWhg-1 X-Mimecast-MFC-AGG-ID: BeNeGRTvM7yzvH2NTzYWhg Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E401F1954ADD; Thu, 5 Dec 2024 13:20:09 +0000 (UTC) Received: from fedora.redhat.com (unknown [10.96.134.195]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id D2A8F3000197; Thu, 5 Dec 2024 13:20:07 +0000 (UTC) From: Guinevere Larsen To: gdb-patches@sourceware.org Cc: Guinevere Larsen , Simon Marchi Subject: [PATCH] gdb: Fix use-after-free when an objfile has no symbols to load Date: Thu, 5 Dec 2024 10:19:59 -0300 Message-ID: <20241205131959.3400690-1-guinevere@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: NEivSr2OVKVriD-MTsfzZVEuI0hVx0hw2MuuHDmLIm0_1733404810 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit content-type: text/plain; charset="US-ASCII"; x-default=true X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org The recent commit moved an initialization of an objfile_holder in syms_from_objfile_1 much earlier in the function, to better deal with when GDB is unable to read the objfile format. However, there is an early exit from syms_from_objfile_1 when the objfile can be understood, but has no symbols. That was not releasing the objfile_holder, so the objfile was being unlinked from the program space, but the process of reading the objfile was being continued, leading to use-after-frees flagged by the Address Sanitizer. This commit fixes that UAF by making the objfile_holder release the objfile right before the early exit. This commit also changes the test gdb.base/dump.exp since that was the original test that flagged the UAF, but at the end of the test the generated files were being deleted, meaning we couldn't redo the test manually after teh fact. That final deletion was removed Reported-by: Simon Marchi --- gdb/symfile.c | 4 ++++ gdb/testsuite/gdb.base/dump.exp | 4 ---- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/gdb/symfile.c b/gdb/symfile.c index 3fd6c8d73a2..28c0d46ab54 100644 --- a/gdb/symfile.c +++ b/gdb/symfile.c @@ -901,6 +901,10 @@ syms_from_objfile_1 (struct objfile *objfile, int num_sections = gdb_bfd_count_sections (objfile->obfd.get ()); objfile->section_offsets.assign (num_sections, 0); + + /* Release the objfile unique pointer, since nothing went wrong + in reading it. */ + objfile_holder.release (); return; } diff --git a/gdb/testsuite/gdb.base/dump.exp b/gdb/testsuite/gdb.base/dump.exp index 3c7bee5ff30..58fedb1d36b 100644 --- a/gdb/testsuite/gdb.base/dump.exp +++ b/gdb/testsuite/gdb.base/dump.exp @@ -564,7 +564,3 @@ if {![string compare $is64bitonly "no"]} { "reload struct as memory, tekhex" \ $struct_val "\*$struct_ptr_type" } - -# clean up files - -remote_exec host "rm -f $filenames" -- 2.47.0