From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id bQKIFEulL2q18gcAWB0awg (envelope-from ) for ; Mon, 15 Jun 2026 03:10:03 -0400 Authentication-Results: simark.ca; dkim=pass (2048-bit key; secure) header.d=gmx.de header.i=ronald.hecht@gmx.de header.a=rsa-sha256 header.s=s31663417 header.b=ci9+3qDL; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 3D0D01E024; Mon, 15 Jun 2026 03:10:03 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-3.1 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [38.145.34.32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id 9B79D1E024 for ; Mon, 15 Jun 2026 03:10:00 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id E51F04B920F0 for ; Mon, 15 Jun 2026 07:09:59 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E51F04B920F0 Authentication-Results: sourceware.org; dkim=pass (2048-bit key, secure) header.d=gmx.de header.i=ronald.hecht@gmx.de header.a=rsa-sha256 header.s=s31663417 header.b=ci9+3qDL Received: from mout.gmx.net (mout.gmx.net [212.227.15.18]) by sourceware.org (Postfix) with ESMTPS id DC2F64B920D9 for ; Mon, 15 Jun 2026 07:09:33 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org DC2F64B920D9 Authentication-Results: sourceware.org; dmarc=pass (p=quarantine dis=none) header.from=gmx.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmx.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org DC2F64B920D9 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=212.227.15.18 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1781507374; cv=none; b=H3aQaR6q/bmzmHpXTeA1VPUHyok7nnHdtaGWK8ju0GowKZBZUloNpgG5qUxIcjurikcYtp0YOpe3EuX+cHAWh0J9fAuh1YI+51CKsDiyXZUfUT9fQIbNV1ydfRWaEilV70bNl1hLIZBZKngxBxzQ6CXhjOqevCjTud5B5wYYGyg= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1781507374; c=relaxed/simple; bh=TIY6ASOmThzAwyIHz6GHSnJEOisKrK+fFIpG/Hdov5s=; h=DKIM-Signature:From:To:Subject:Date:Message-ID:MIME-Version; b=JfIGIfaHOhZ9DVEjAjPf3CeYRNEfCPgZ9FNO3fZldSlDmeKFmWfjj4rJhrKmEUBQ2A4fvDsqNtao4iBKRwIvdvKx5cN89jbMQYjiKEhdQL8CBCQmP0PlJKfsC/Sj9CDGlN8pnJVfpXwczIOC+UUxjfgbMHKSjoexjXnbkCa+j0E= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (2048-bit key, secure) header.d=gmx.de header.i=ronald.hecht@gmx.de header.a=rsa-sha256 header.s=s31663417 header.b=ci9+3qDL DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org DC2F64B920D9 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmx.de; s=s31663417; t=1781507372; x=1782112172; i=ronald.hecht@gmx.de; bh=gLZN2EKNJ91Uy5grM3pSiBy1+3KBbQ1uWt3V2PO1d68=; h=X-UI-Sender-Class:From:To:Cc:Subject:Date:Message-ID:In-Reply-To: References:MIME-Version:Content-Transfer-Encoding:cc: content-transfer-encoding:content-type:date:from:message-id: mime-version:reply-to:subject:to; b=ci9+3qDLzIHsoFk9coyJmaApXhdk1zECEvLTSoZ2fDHLGuAAzALAhoCHg+Cu86ot nf49VPSjmZvNDfyN0AJ1Wzx7D5DkrxMDjYgybVfC0hmrjH387kTxbuOKthi0Fd06t i7eLXv3/4o1g9Bz9fNz6bT5TEf4Murgklg27MtxyYIeF+ogfJLc+RO+uk+X7X+mxf oJbUOuoVewtGpYoLa3cJRcnA+weH4ygXCiMHr9ei9WpN4JKDIjaDTKtUAcXaumC/h Slfe/vK3zRbJPFG9DTCi/SXsHbFgr/wUsv2bIqoE+3EMBDAQHMSWtqSA2qHktZhHP aYSN68j3ZrfmOJSJPA== X-UI-Sender-Class: 724b4f7f-cbec-4199-ad4e-598c01a50d3a Received: from client.hidden.invalid by mail.gmx.net (mrgmx005 [212.227.17.190]) with ESMTPSA (Nemesis) id 1MMXQ5-1wolTA0vcl-00KWQF; Mon, 15 Jun 2026 09:04:27 +0200 From: Ronald Hecht To: gdb-patches@sourceware.org Cc: Ronald Hecht Subject: [PATCH v3] gdb: z80: Fix endless loop in frame unwinder and validate saved register types Date: Mon, 15 Jun 2026 09:04:01 +0200 Message-ID: <20260615070401.8671-1-ronald.hecht@gmx.de> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260614150230.2fd33d6e@f44-mesa-1> References: <20260614150230.2fd33d6e@f44-mesa-1> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:8UU7IawaavIvUnwzi2cRjvGhLEgAANp6XkzockpVxIhvrzGekmL 0qCFXiHOC+uiHt5Ttjcr5XdYp9nMmYcpXpo/n85RuLrJisPb73BOeIyQPxfG9j2NT2DxlaZ DBYcYfbOCbd7QrUC0p8hC0WBv+t4Y0wTRKtbKHB3OlsHYKE8go8byDijpOTWzFaR9twhBDY hfUtVAgNjaKd3YUmXucDw== UI-OutboundReport: notjunk:1;M01:P0:rmHXMh257ic=;Nb/S6XHx7SXQHvYt4m1shkgv4Bk 9uTMbUDkkxDyyY+Tp+bj9DxD4FFAFR242OK7MNtrRbNPCbPA86jfLyAtY9Xi+v9E+/5W8Yc02 Od3ktJXb7TS3zVt3+ibmKF2hptx6PmJ5mp/agAPTlzBIsd8TxeIZSsjs1esPSAOndUI9kpYqk 6ilkc/1eXxtzXserP8SGqoQnapZpFlcldkhevkr+9NZi9K3Tc9kzOAE8eMT1XSD22HQIIewe/ SseJz7SdJG8gBPEM1cguJWGILiCmHOwdmzj8rvhvUU/n0roK4AsOGWIUBFDhfYKIC1qVo7z0+ kdvzf6N9u2tburt7EICbYtte22cYEU9HRoceyK6RaXU0/eucIWFBZdnNdcTlDAse1JGiHKcZU zbn/Poi4cwn4gkqfQJbXIAVKzxmZKF5i71If/Yu8FlrOYwSkyuSjXy6OK4BSmLtGKUSSpCCbE 0sSDrpBaZ2Kn/j5ddjWBL0jUNbiaz6GkGdzQwBahFCvmCdnCA5KFuMXECnItArnPtFQKEc6fA JjNTk2bZkhIMWZDM8zVhyz911Hl+vvdheNUTeOBbGZ2HWm8WA/eBf6d4dD2YL7xsBFp76PNmw z8r6SmThK8i7ZNgPRUx755xI2Gn64q75y29guX5iBeUY3JCg6QBsrpX+pbck+KwBEMDy8bIDn CppkBz6QKC9GpZiAT1a9vXCx2JrwiKx4Zwty2VYMKmtNZsT2dmSq7lgGqMtP7yVeDFGJiRUc3 yuYsb8uYbzlVrzAGz9Zk0EbacrSgAxzJzalDUN5j7Rm5YaW3g48s093XWnJcie1fFPjSs6EBB Fsya5FVAmZ6NDdwE5VRxYFFv1vgDgycaXvErmclfgKu0BYZMHo5nJclA/QKAhtljk6JCx7fHT f2PIVEd0Vuuio5traIhf0XNZmlrF8N0X2ZJLWeYLTKmBLKMfn0UBlCxyYuBiVHaMWChpY+Q1/ JiTHiqFvUvZGodjGhZSIlF64gqGSyYdP0sgXe0JEthcGL2j2wpj6HHW+y8nJSMP269ji6fHPC LaivNHLo2p3AoL+0DVx8gw9MT7VfgA0+K7p0x2iIa0iOZpplW6QxG8lyIXm/7RfPHyobGmrN1 2S5l38Acvi6j16jnBUX2ezDbK4LcBBFabPNwsYj21TccgWgIFDYc8AHFG5oniuQFNj2OpEFR2 vm2wTK8UIEecsv1S3Uon+Fw+8waGzlvH1HRoc6bQ1xMpNYiZxATSDJFey+WOOfBhAycssth2S KcHLjRCZrCukCr48BK77GICv32REzsd7mfr7jM1WEX1OIkVuBdLK/DFk0prpInLMRvQzizPgw 0uk8sop+U8gxl+VXAQJ+Q8cZ6bawc5cEvcs2YvFIG9WZRwX7AcpoM3fQpIsNN+SSWzTSBfZL0 t7exG0Z3DyVZOBw1taN6+0RfuOLpwTQjMt5DZTfc500TKmM7wiMJQrYAS1pZ7SmEF1z17Nc8M uKdXZu+3X0SRkiH23/zeVC6rNj4O7UniOt7CQBgliP1mx0TPfqRmPRRE8Qi/CZJtvtaxYyl7L KclxJ+/9KEYdnmWlrTIfK3rX005fPKY9SJpTzK6tkB9fxt41aznIZLFMfhPrjuodWuHl76nzH FJ62BEQOKfMLTRnhFXqHm7d1Rw1FjVw6o2Xoyj7vUX9zL0HvKwv9+vHbYuS2T2mY7/r80nU7N u+ljKTWgdJ4mujT9/fUYJI7ybmKYDlZr+xuYpSktuMXcS9GFXdIIXsmllBf0o7qnlgEem73ys ae6AHJjz67a3IH/PifF+XszjEdUsJ1sM/fvdg24N64dQiAKHQSs1TFaljAY+pVgOxFMZz+kDc yO/boZExy1iqy4t+QTMR5+zrV3X3et1B+B8bj8JV28WEIT+3FHHfQxEg5nJn+JpQZcqCxe96m sIKYRjXDsE/X6gAqeY48isUSJZPXTIZUc7lnQR9/2kmLh3yrPLp4NAqA7YV70EZtXcMA1szW3 bLkAN5ZnPvgn6na7vNb1+V9Us+zZGC2OXE9a5pr7x/E7cdiEHrgG+HJMxWOyhOk8BB3dLRJT4 pH5zfWXF0rS66CqBgK8ICmFYNBx//v1d7UT0oDSBJ6cmvvjmwHCv4dAA8ufC4PkHIsD0rjU01 Tq8dpE5+5KBMVD0GQeBYZouhKbcXOwuKYRo7sa8O8XkzqZURQBJNyO8BqZ/FfTf76/DegpLL5 cN28768yeMZj2YHr6EirtXH3GG7r3XsFcnBXXx26+F22TZRIpmqmN5Z8P4LZHgOHQnSxP4mVw T5thXKKvDmIDlg+M5hVoSN6lAAX2YPClP9hD3t6Kfi/ATWE2ohJJMD3nM55GrPFW2WtF0ZtCs i1mYmbSBInTbRgusBxbf/f/be1lbmtghy/jKgikvOkchSv7gOvGRxWSj+zOoV3Mp4oAhj/Kbw YzB1FDvZeMRXSnMr1jbpsWRkaFck8x/Lf0djuZmtVrYwF+CK5iUo4pDrv2sKUN8bCYs+7hRXk Rv3d/+q1Z2lHNJ8FkwsC6LZFilY2TnOWNgCkya4LVnxmcyGSs6G6Q6RAE4W3DTNwhahbIazJ+ FtJ9sHOCEMaSCtVwKKmuxxGBhvnzJ28cvq/lAEBuUdZDbhInFmqK++ewzU5EDuN0AeZl6qtXA Zwa6duR6QqJ9jsgPi7PpwVm0+5OouZ2e3zu4Im7lQmXau3MOuG1qyhhYqVxkZYaRyeXNd2vcG hC1dIuaHGCHRNsMtWTnl4T7hDQOdlhbAUC0lOCpq+DUKzgNFkrHLJa9WrT0zsimE5mfNo13Hp SWETBGcAUP+LGCiVwnjwY61q5QOPC0AN1ZJhc1C37qKZ9h7IsFebd7GB+gLfSyN0Zuor3I8B+ SHAZI0ribTDqMmhVAPSY++oo89H0HlzRFmPoRxQToOJ92a1kBFag9RiwuW6tjhYS/zydHcoHz 1YrXFpf4TfhGH+rQFPMttmY8pVY7CwlntuTPTT25WymELPchW4mBMY/AH8DcsxytkxCmEJ1bV MG3RM1nJa/qqEEe8cPX2sLPtIUvww84kSGatT2I5RD5yiWSixFXNntIJj+MJ/c05uPX1aFVV5 3KfuH625MHmpExHLws/dUL7xM/WwhZO1hddd3spiyPzJE01Qiv6EkFl3dmZIjHnJVbyRdHRed Chl38MDntplGe0V1547b4vQ818M9/kvRzHshS8IXicr7MDxE8f4QMiZZcde29iyMLP61koMBL bHC/axxS4Qv9gvIOUJA/TrOpjG+VQVINc5eERXXBAu+uKBcDNkJnfeydwM4BpCMB8eGGue7vI qo6a0WLqSWjr8PVZ+F/YNIh2CaTUNHri2Ra1ebkKUDTEhSVZ08v7ahAYj7UYkTz146E9oCThn EYcTzZniF4+ffBhJdruFFi7teIhmJekimnGEAzMMzBBxnSETTsPOJ4Ie+JIb6xZwLNbten9Op NWv3D465nei94T6Sjiwenup3/3Pe75BXB0XNTFp8RdRXk11d2wM1D8dS4SuqWRupa62Zt7lyY MkdeddcjtRc3Z+L+56cwXoy+n677ua1/6J6pZ0yoxUBUQKQK2uXYyNWRoPDOU8ptE12yad1yP xgdhiGJgp+Duw3/N9dRiU4X6jcDD9cKWukIU3gRDvfrZLmhhmkUEkufnWEfRhjUe70ZnkkQ5U fkiQeqe8IBcPGGd6EFSo1fWh0ZLNW46m1jZYoZqUzYAHv6TgynNg3j9XyTytffOa10kxQucUI jVSt0MCpyzBAHQgzvchfu0Ycue8dnF5l1imifz+wtuBEQQpI9PKytnsETf7G1QBUi7NYMStHA yPiHDQMkBti9LZIzUBCHj9pZkVNRERajO++7LVm40KjclGovFs8l7WwaJkNSgAoyhvi82DY+t e36RONt+bAhm/1oHYSqOB4PYdcNCDpVOKgrwXoL2lg2YtN1yk6wK7Zzk5HEl9sl6Tn44sMA+i HtH8Hm4h3h4mYq4H3IkcerqBa7gBcolXfrJz0z/51xSwgQw+AAOwIzAHLjZPCIo57UlfZzEAV D5A0LzexPPIQM44xV+FtplpESagX7DaG3nevgDGckNgmDhz23r6eg9hhPn+akY0Adwk32NofH xmIxk6eJgjrQ8kz7GNnhnVxNEi8r9bH8oYFkAi+pC5np3fOAzNtgejHqlNcyRNaDvhDteAx/+ qKH9M65YS0Vo+ZSt0bsk0EkHDIRy+1ml0Tx/SJh3UBLWrKj2XS91uluzV9sFF3IwBoOK2sayF TQTQZAOGHmDdxNpBINq28FtwRoCkiPjYk+vodth1/RTprqv9ZFErlAxzugPCoRKfeDFstXurt bTfFgCdA2SVhEdc+RfzM3K+7Vjv17gEJ1k3WXyy45Qg8ZEy5C9FxR9HJzWVGtnDwbYFFQrV9M 5BLyrV80yE0tnoctezyCEPeCyfZCYeFYA2q6ZwsUFjmkpngN9MiZWgj8TKsJMoA02jBPFUou+ pRZgMsdV9wCcu9n8mazxuHuNE/X6M66wk/2FuCFKwUev6KKtzFrUkYzse61mKySxY3JKqweoi eKZvDc0DX4N55mX3Xdmg6vJS0FWkMxDyQwAMBZnID+WBDLaRRm1y0m6Ke2tli8FGE+4EXUS+E x4ymJxSvFMGa3LIW92neYehHNrd/00rFt5cGvZmHZG8T+RecDr5Kh+k37QxOQp9rGR8b84RCK sYoTaoKYDPlfkETsu9dL7Zim5oO4IFAiVOsxy5ajVx1/YHK4e4FP2Xnc31k2ZfpemLe0XZAl2 /U2OwX5f14sj2cEml+Tki20Usf9f5wDVdmeWwdZRKDQAonojruq9cgMucgzqtlYtOyYKtCex4 O+6cD/iFNEaMY4hp3z9OsteAti+Zsri7aFZkoT80aONkbVUw5lpOT/qfYuanWw2gAHwnRmDXk nfMJGeBtVatXNm59d8qhHkN2ELGaeGZ+aHtcfcUrFWqEePlMkzsWJS8ydu6O/kM97lSZ79MfO WHdJaxxa8PHMe5BqsYMUa0/q/NqcfWh0kavoM36wZ5pgiUHzU/gaRQm0dyReVXNbqxN5qrTbA jMSL5TymhSJs/l37ceL4nbZ8f5D/rwXMxFWo0WWfwqSqMqMvf0e7LXYTAUhByBzw2SUZ/kAA1 VxO8NpnMw4G91syDR0UZAGug7cuD/TYDRBVKQY/qkTdMxPxujNpLPQMqS5oAB0p1yrCwoPUMV yg63W3CtzWa5L6JwpjmMns+wFTxjDukKSx3fDeCmD29kd5CeXU0CiNhjC/ew7sIkvBuBFCY7I h8AIjvIzG9SORIsX4cE1qVyQDLafKaX9u2R04RPVJ6iOLDOkLpb9GWKx/1txEfP9/VNGPCnIS ufN/Yu5MbynekChmJjJyAnR+wm05SBUh+a+QmrHYQy4EoUB/K/dLfOHp3gAby62UV7TyTpGnQ ZZaIyJb8wrgLd9BGu2oOeF6CgEyrAMBbxcjoUvH8gVPm+LDjSaX9RjZut8OM9W4+y8nFan3Y+ UvPNs/LJA8ySRL2nnCnvU7ROrQffd5lkGPOyv5Z8qonlOaGAyrCcqO9vPG6Qj56sGL2uMzLyP I32L352aOd2ax9AfrmmDSNmbb8gMjAmeEyRknPZ0ui/JThhsnWwK4udmAX3L9uB6ELg3xMEYE QQiqlztIrADsXygrwIlHdP2iff4R+Th300XlVRKqBlI5QEjdeDgUNUALEgwFRPilEC0T1k1AB oGjx6eoBuxJzHmehW0= X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org In z80_frame_unwind_cache, the loop scanning for the frame base pointer (for (;; ++sp)) could run into an endless loop or scan too far if the termination condition (sp < this_base) was not met due to corrupted or unexpected stack layouts. This patch introduces a loop_count to limit the scan to a maximum of 2 * addr_len iterations. Additionally, when iterating through saved registers to adjust their offsets into concrete addresses, the code now explicitly checks if the register actually holds an address using is_addr() before calling addr(). This prevents potential assertions or undefined behavior for registers that do not contain valid address data. gdb/ChangeLog: * z80-tdep.c (z80_frame_unwind_cache): Limit stack scanning to 2 * addr_len iterations to prevent endless loops. Check is_addr() before adjusting saved register addresses. =2D-- gdb/z80-tdep.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) diff --git a/gdb/z80-tdep.c b/gdb/z80-tdep.c index 3a0d5f7e..6828894f 100644 =2D-- a/gdb/z80-tdep.c +++ b/gdb/z80-tdep.c @@ -595,17 +595,27 @@ z80_frame_unwind_cache (const frame_info_ptr &this_f= rame, { CORE_ADDR addr; CORE_ADDR sp; - CORE_ADDR sp_mask =3D (1 << gdbarch_ptr_bit(gdbarch)) - 1; + CORE_ADDR addr_space_max =3D (1 << gdbarch_ptr_bit(gdbarch)) - 1; enum bfd_endian byte_order =3D gdbarch_byte_order (gdbarch); + int loop_count =3D 0; /* Assume that the FP is this frame's SP but with that pushed stack space added back. */ this_base =3D get_frame_register_unsigned (this_frame, Z80_SP_REGNU= M); sp =3D this_base + info->size; for (;; ++sp) { - sp &=3D sp_mask; - if (sp < this_base) - { /* overflow, looks like end of stack */ + /* Limit the scan to 2 * addr_len iterations. If the unwinder's + frame size calculation is slightly off (e.g. due to unpopped + arguments or temporary pushes), the return address might be + hidden a few bytes deeper. Scanning up to 2 * addr_len bytes + comfortably covers two misplaced pointer-sized values. + Scanning further drastically increases the risk of false + positives: we might wander into the caller's local variables, + hit a random CALL or conditional CALL opcode, and generate a + corrupted backtrace. It also prevents massive slow-downs on + remote serial targets if the stack is severely corrupted. */ + if (++loop_count > 2 * addr_len || sp > addr_space_max) + { /* Limit reached or end of address space, assume end of stack. */ sp =3D this_base + info->size; break; } @@ -644,9 +654,14 @@ z80_frame_unwind_cache (const frame_info_ptr &this_fr= ame, /* Adjust all the saved registers so that they contain addresses and no= t offsets. */ for (i =3D 0; i < gdbarch_num_regs (gdbarch) - 1; i++) - if (info->saved_regs[i].addr () > 0) - info->saved_regs[i].set_addr - (info->prev_sp - info->saved_regs[i].addr () * addr_len); + { + if (info->saved_regs[i].is_addr ()) + { + if (info->saved_regs[i].addr () > 0) + info->saved_regs[i].set_addr + (info->prev_sp - info->saved_regs[i].addr () * addr_len); + } + } =20 /* Except for the startup code, the return PC is always saved on the stack and is at the base of the frame. */ =2D-=20 2.43.0