Go to file
Pedro Alves 7905fc359d Fix "nosharedlibrary + continue + shared lib event" crash
On systems that use the probes-based solib interface, GDB misbehaves
if you run the "nosharelibrary" command, continue execution, and then
the program hits the shared library event breakpoint.  On my system it
aborts like this:

 (gdb) nosharedlibrary
 (gdb) c
 Continuing.
 pure virtual method called
 terminate called without an active exception
 Aborted (core dumped)

Though it's really undefined behavior territory, caused by deferencing
a dangling solib event probe pointer.

I've observed this by running "nosharedlibrary" when stopped at the
entry point, but it should happen at any other point, if the program
does a dlopen/dlclose after.

The fix is to discard an objfile's probes from the svr4 probes table
when an objfile is about to be released.

New test included, works with both native and gdbserver testing.

Valgrind log:

 (gdb) starti
 (gdb) nosharedlibrary
 (gdb) c
 Continuing.
 ==24895== Invalid read of size 8
 ==24895==    at 0x89E5FB: solib_event_probe_action(probe_and_action*) (solib-svr4.c:1735)
 ==24895==    by 0x89E95A: svr4_handle_solib_event() (solib-svr4.c:1872)
 ==24895==    by 0x8A7198: handle_solib_event() (solib.c:1274)
 ==24895==    by 0x4E3407: bpstat_stop_status(address_space const*, unsigned long, thread_info*, target_waitstatus const*, bpstats*) (breakpoint.c:5407)
 ==24895==    by 0x721F41: handle_signal_stop(execution_control_state*) (infrun.c:5685)
 ==24895==    by 0x720B11: handle_inferior_event(execution_control_state*) (infrun.c:5129)
 ==24895==    by 0x71DD93: fetch_inferior_event(void*) (infrun.c:3748)
 ==24895==    by 0x7059C3: inferior_event_handler(inferior_event_type, void*) (inf-loop.c:43)
 ==24895==    by 0x874DF0: remote_async_serial_handler(serial*, void*) (remote.c:14039)
 ==24895==    by 0x894101: run_async_handler_and_reschedule(serial*) (ser-base.c:137)
 ==24895==    by 0x8941E6: fd_event(int, void*) (ser-base.c:188)
 ==24895==    by 0x67AFEF: handle_file_event(file_handler*, int) (event-loop.c:732)
 ==24895==  Address 0x18b63860 is 0 bytes inside a block of size 136 free'd
 ==24895==    at 0x4C2E616: operator delete(void*, unsigned long) (vg_replace_malloc.c:585)
 ==24895==    by 0x8C6A12: stap_probe::~stap_probe() (stap-probe.c:124)
 ==24895==    by 0x66F7DB: probe_key_free(bfd*, void*) (elfread.c:1382)
 ==24895==    by 0x69B705: bfdregistry_callback_adaptor(void (*)(registry_container*, void*), registry_container*, void*) (gdb_bfd.c:131)
 ==24895==    by 0x855A57: registry_clear_data(registry_data_registry*, void (*)(void (*)(registry_container*, void*), registry_container*, void*), registry_container*, registry_fields*) (registry.c:79)
 ==24895==    by 0x855B01: registry_container_free_data(registry_data_registry*, void (*)(void (*)(registry_container*, void*), registry_container*, void*), registry_container*, registry_fields*) (registry.c:92)
 ==24895==    by 0x69B783: bfd_free_data(bfd*) (gdb_bfd.c:131)
 ==24895==    by 0x69C4BA: gdb_bfd_unref(bfd*) (gdb_bfd.c:609)
 ==24895==    by 0x7CC33F: objfile::~objfile() (objfiles.c:651)
 ==24895==    by 0x7CD559: objfile_purge_solibs() (objfiles.c:1021)
 ==24895==    by 0x8A7132: no_shared_libraries(char const*, int) (solib.c:1252)
 ==24895==    by 0x548E3D: do_const_cfunc(cmd_list_element*, char const*, int) (cli-decode.c:106)
 ==24895==  Block was alloc'd at
 ==24895==    at 0x4C2D42A: operator new(unsigned long) (vg_replace_malloc.c:334)
 ==24895==    by 0x8C527C: handle_stap_probe(objfile*, sdt_note*, std::vector<probe*, std::allocator<probe*> >*, unsigned long) (stap-probe.c:1561)
 ==24895==    by 0x8C5535: stap_static_probe_ops::get_probes(std::vector<probe*, std::allocator<probe*> >*, objfile*) const (stap-probe.c:1656)
 ==24895==    by 0x66F71B: elf_get_probes(objfile*) (elfread.c:1365)
 ==24895==    by 0x7EDD85: find_probes_in_objfile(objfile*, char const*, char const*) (probe.c:227)
 ==24895==    by 0x4DF382: create_longjmp_master_breakpoint() (breakpoint.c:3275)
 ==24895==    by 0x4F6562: breakpoint_re_set() (breakpoint.c:13828)
 ==24895==    by 0x8A66AA: solib_add(char const*, int, int) (solib.c:1010)
 ==24895==    by 0x89F7C6: enable_break(svr4_info*, int) (solib-svr4.c:2360)
 ==24895==    by 0x8A104C: svr4_solib_create_inferior_hook(int) (solib-svr4.c:2992)
 ==24895==    by 0x8A70B9: solib_create_inferior_hook(int) (solib.c:1215)
 ==24895==    by 0x70C073: post_create_inferior(target_ops*, int) (infcmd.c:467)
 ==24895==
 pure virtual method called
 terminate called without an active exception
 ==24895==
 ==24895== Process terminating with default action of signal 6 (SIGABRT): dumping core
 ==24895==    at 0x7CF3750: raise (raise.c:51)
 ==24895==    by 0x7CF4D30: abort (abort.c:79)
 ==24895==    by 0xB008F4: __gnu_cxx::__verbose_terminate_handler() (in build/gdb/gdb)
 ==24895==    by 0xAFF845: __cxxabiv1::__terminate(void (*)()) (in build/gdb/gdb)
 ==24895==    by 0xAFF890: std::terminate() (in build/gdb/gdb)
 ==24895==    by 0xAFF95E: __cxa_pure_virtual (in build/gdb/gdb)
 ==24895==    by 0x89E610: solib_event_probe_action(probe_and_action*) (solib-svr4.c:1735)
 ==24895==    by 0x89E95A: svr4_handle_solib_event() (solib-svr4.c:1872)
 ==24895==    by 0x8A7198: handle_solib_event() (solib.c:1274)
 ==24895==    by 0x4E3407: bpstat_stop_status(address_space const*, unsigned long, thread_info*, target_waitstatus const*, bpstats*) (breakpoint.c:5407)
 ==24895==    by 0x721F41: handle_signal_stop(execution_control_state*) (infrun.c:5685)
 ==24895==    by 0x720B11: handle_inferior_event(execution_control_state*) (infrun.c:5129)
 ==24895==

Note, this little bit in the patch is just a cleanup that I noticed:

 -  lookup.prob = prob;
    lookup.address = address;

That line isn't necessary because hashing/comparison only looks at the
address.

gdb/ChangeLog:
2019-04-22  Pedro Alves  <palves@redhat.com>

	* solib-svr4.c (svr4_free_objfile_observer): New.
	(probe_and_action::objfile): New field.
	(probes_table_htab_remove_objfile_probes)
	(probes_table_remove_objfile_probes): New functions.
	(register_solib_event_probe): Add 'objfile' parameter.  Store it
	in the new probe_and_action.  Don't store the probe in 'lookup'.
	(svr4_create_probe_breakpoints): Pass objfile to
	register_solib_event_probe.
	(_initialize_svr4_solib): Register a free_objfile observer.

gdb/testsuite/ChangeLog:
2019-04-22  Pedro Alves  <palves@redhat.com>

	* gdb.base/solib-probes-nosharedlibrary.c,
	gdb.base/solib-probes-nosharedlibrary.exp: New files.
2019-04-22 14:20:59 +01:00
bfd Automatic date update in version.in 2019-04-22 00:00:46 +00:00
binutils ns32k testsuite tidy 2019-04-16 19:59:55 +09:30
config Add markers for 2.32 branch to NEWS and ChangeLog files. 2019-01-19 15:55:50 +00:00
contrib
cpu Add markers for 2.32 branch to NEWS and ChangeLog files. 2019-01-19 15:55:50 +00:00
elfcpp [binutils, ARM, 10/16] BFCSEL infrastructure with new global reloc R_ARM_THM_BF12 2019-04-15 12:31:34 +01:00
etc Update year range in copyright notice of binutils files 2019-01-01 22:06:53 +10:30
gas RX Assembler: Ensure that the internal limit on the number of relaxation iterations is not larger that the external limit. 2019-04-19 10:39:47 +01:00
gdb Fix "nosharedlibrary + continue + shared lib event" crash 2019-04-22 14:20:59 +01:00
gold Check whether symbols with MOVW_.ABS relocations require PLT entries (aarch64). 2019-02-19 16:13:24 -08:00
gprof PR24402, global buffer overflow in symtab_finalize 2019-04-01 13:35:15 +10:30
include [binutils, ARM, 10/16] BFCSEL infrastructure with new global reloc R_ARM_THM_BF12 2019-04-15 12:31:34 +01:00
intl Change version to 2.32.51 and regenerate configure and pot files. 2019-01-19 16:51:42 +00:00
ld s12z and h8300 no-print-map-discarded fails 2019-04-19 12:41:58 +09:30
libdecnumber
libiberty Pull in patch for libiberty that fixes a stack exhaustion bug when demangling a pathalogically constructed mangled name. 2019-04-10 15:49:36 +01:00
opcodes [binutils, ARM, 16/16] Add support to VLDR and VSTR of system registers 2019-04-15 12:32:01 +01:00
readline Readline: Cleanup some warnings 2019-01-31 17:25:06 +00:00
sim sim: Use host not target byte order for merging and splitting values 2019-04-13 22:21:14 +01:00
texinfo
zlib
.cvsignore
.gitattributes
.gitignore
ar-lib
ChangeLog Pull in patch for libiberty that fixes a stack exhaustion bug when demangling a pathalogically constructed mangled name. 2019-04-10 15:49:36 +01:00
compile
config-ml.in
config.guess Sync config.guess, config.sub from GCC 2019-01-14 15:47:35 +01:00
config.rpath
config.sub Sync config.guess, config.sub from GCC 2019-01-14 15:47:35 +01:00
configure Don't build readline/libreadline.a, when --with-system-readline is supplied 2019-01-03 00:03:34 -05:00
configure.ac Don't build readline/libreadline.a, when --with-system-readline is supplied 2019-01-03 00:03:34 -05:00
COPYING
COPYING3
COPYING3.LIB
COPYING.LIB
COPYING.LIBGLOSS
COPYING.NEWLIB
depcomp
djunpack.bat
install-sh
libtool.m4
lt~obsolete.m4
ltgcc.m4
ltmain.sh
ltoptions.m4
ltsugar.m4
ltversion.m4
MAINTAINERS
Makefile.def
Makefile.in
Makefile.tpl
makefile.vms
missing
mkdep
mkinstalldirs
move-if-change
multilib.am
README
README-maintainer-mode
setup.com
src-release.sh Move potentially obsolete BFD targets into the definitely obsolete section. Add a note to the README-how-to-make-a-release document about doing this. 2019-02-07 14:30:02 +00:00
symlink-tree
test-driver
ylwrap

		   README for GNU development tools

This directory contains various GNU compilers, assemblers, linkers, 
debuggers, etc., plus their support routines, definitions, and documentation.

If you are receiving this as part of a GDB release, see the file gdb/README.
If with a binutils release, see binutils/README;  if with a libg++ release,
see libg++/README, etc.  That'll give you info about this
package -- supported targets, how to use it, how to report bugs, etc.

It is now possible to automatically configure and build a variety of
tools with one command.  To build all of the tools contained herein,
run the ``configure'' script here, e.g.:

	./configure 
	make

To install them (by default in /usr/local/bin, /usr/local/lib, etc),
then do:
	make install

(If the configure script can't determine your type of computer, give it
the name as an argument, for instance ``./configure sun4''.  You can
use the script ``config.sub'' to test whether a name is recognized; if
it is, config.sub translates it to a triplet specifying CPU, vendor,
and OS.)

If you have more than one compiler on your system, it is often best to
explicitly set CC in the environment before running configure, and to
also set CC when running make.  For example (assuming sh/bash/ksh):

	CC=gcc ./configure
	make

A similar example using csh:

	setenv CC gcc
	./configure
	make

Much of the code and documentation enclosed is copyright by
the Free Software Foundation, Inc.  See the file COPYING or
COPYING.LIB in the various directories, for a description of the
GNU General Public License terms under which you can copy the files.

REPORTING BUGS: Again, see gdb/README, binutils/README, etc., for info
on where and how to report problems.