Page MenuHomePhabricator

[DebugInfo] - Fix attempts of reading past the end of .eh_frame in DWARFDebugFrame::parse().
ClosedPublic

Authored by grimar on Wed, May 20, 8:07 AM.

Details

Summary

I've noticed an issue with "Data.getRelocatedValue(...)" call.

it might silently ignore an error when a content is truncated.
That leads to an infinite loop in the code (e.g. llvm-readobj hangs).

After fixing the issue I've found that actually we always tried
to read past the end of a section, even when a content was valid.
It happened because the terminator CIE (a CIE with the length == 0)
was never handled. At first I've tried just to stop adding the terminator
entry (and return), but it does not seem to be correct, because tools like
llvm-objdump might want to print something for such entries
(see comments in the code and test cases).

This patch fixes issues mentioned, provides new test cases for
both llvm-readobj and lib/DebugInfo and adds FIXMEs to existent
test cases related.

Diff Detail

Event Timeline

grimar created this revision.Wed, May 20, 8:07 AM
aprantl added inline comments.Thu, May 21, 9:26 AM
llvm/lib/DebugInfo/DWARF/DWARFDebugFrame.cpp
381

do -> to

what is "something special"?

Fix multiple issues in DWARFDebugFrame::parse().

Better to call out the exact problems: truncated contents issues.

llvm/lib/DebugInfo/DWARF/DWARFDebugFrame.cpp
381

Do you mean readelf -wf/objdump -Wf output ZERO terminator?

This code here is correct. According to D46566: glibc unwind-dw2-fde.c classify_object_over_fdes has (I just checked, it still has) an oob problem if there is no ZERO terminator.

388

Minor nit: push_back (does not require a special constructor)

llvm/test/DebugInfo/X86/eh-frame-truncated.s
5

-unknown-linux can be dropped (generic ELF behavior)

grimar added a comment.EditedFri, May 22, 1:47 AM

Fix multiple issues in DWARFDebugFrame::parse().

Better to call out the exact problems: truncated contents issues.

It is not only about truncation. CIE terminator entries were not handled and we tried to
read past the end of section buffer. Though no visible issue/crash happened because the error
was never reported.

Upd: I've adjusted the patch name a bit.

grimar updated this revision to Diff 265678.Fri, May 22, 1:55 AM
grimar marked 6 inline comments as done.
  • Addressed review comments.
llvm/lib/DebugInfo/DWARF/DWARFDebugFrame.cpp
381

what is "something special"?

Do you mean readelf -wf/objdump -Wf output ZERO terminator?

Yeah. I've updated the comment to clarify.

388

Right, thanks!

grimar retitled this revision from [DebugInfo] - Fix multiple issues in DWARFDebugFrame::parse(). to [DebugInfo] - Fix attempts of reading past the end of .eh_frame in DWARFDebugFrame::parse()..Fri, May 22, 1:58 AM
MaskRay accepted this revision.Fri, May 22, 12:11 PM

LGTM. Probably worth giving other reviewers a change to comment (May 25 is a US holiday)

llvm/test/DebugInfo/X86/eh-frame-truncated.s
2

the content

the content of .eh_frame
or
the content of the .eh_frame section

This revision is now accepted and ready to land.Fri, May 22, 12:11 PM
MaskRay added inline comments.Fri, May 22, 12:12 PM
llvm/lib/DebugInfo/DWARF/DWARFDebugFrame.cpp
382

llvm-objdump --dwarf=frames

Giving a bit more context here helps the reader.

grimar updated this revision to Diff 265864.Sat, May 23, 7:56 AM
grimar marked 2 inline comments as done.
  • Addressed review comments.
jhenderson accepted this revision.Tue, May 26, 1:24 AM

LGTM, with nit (somehow forgot to submit this when previously reviewing it, sorry for the delay).

llvm/test/tools/llvm-readobj/ELF/unwind.test
247

contains a truncated -> contains truncated

This revision was automatically updated to reflect the committed changes.