[Lldb-commits] [PATCH] D141165: [lldb] Fix symbol table use after free

[Augusto Noronha via Phabricator via lldb-commits]

augusto2112 created this revision.
augusto2112 added reviewers: labath, jingham, JDevlieghere.
Herald added a project: All.
augusto2112 requested review of this revision.
Herald added a project: LLDB.
Herald added a subscriber: lldb-commits.

The symbol file stores a raw pointer to the main object file's symbol
table. This pointer, however, can be freed, if ObjectFile::ClearSymtab
is ever called. This patch makes sure the pointer to the symbol file
is valid before using it.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D141165

Files:
  lldb/include/lldb/Symbol/SymbolFile.h
  lldb/source/Symbol/SymbolFile.cpp


Index: lldb/source/Symbol/SymbolFile.cpp
===================================================================
--- lldb/source/Symbol/SymbolFile.cpp
+++ lldb/source/Symbol/SymbolFile.cpp
@@ -164,16 +164,15 @@
 
 Symtab *SymbolFileCommon::GetSymtab() {
   std::lock_guard<std::recursive_mutex> guard(GetModuleMutex());
-  if (m_symtab)
-    return m_symtab;
-
   // Fetch the symtab from the main object file.
-  m_symtab = GetMainObjectFile()->GetSymtab();
-
-  // Then add our symbols to it.
-  if (m_symtab)
-    AddSymbols(*m_symtab);
+  auto *symtab = GetMainObjectFile()->GetSymtab();
+  if (m_symtab != symtab) {
+    m_symtab = symtab;
 
+    // Then add our symbols to it.
+    if (m_symtab)
+      AddSymbols(*m_symtab);
+  }
   return m_symtab;
 }
 
@@ -186,8 +185,9 @@
   ObjectFile *symfile_objfile = GetObjectFile();
   if (symfile_objfile != module_objfile)
     symfile_objfile->SectionFileAddressesChanged();
-  if (m_symtab)
-    m_symtab->SectionFileAddressesChanged();
+  auto *symtab = GetSymtab();
+  if (symtab)
+    symtab->SectionFileAddressesChanged();
 }
 
 uint32_t SymbolFileCommon::GetNumCompileUnits() {
Index: lldb/include/lldb/Symbol/SymbolFile.h
===================================================================
--- lldb/include/lldb/Symbol/SymbolFile.h
+++ lldb/include/lldb/Symbol/SymbolFile.h
@@ -503,7 +503,6 @@
                                    // file)
   llvm::Optional<std::vector<lldb::CompUnitSP>> m_compile_units;
   TypeList m_type_list;
-  Symtab *m_symtab = nullptr;
   uint32_t m_abilities = 0;
   bool m_calculated_abilities = false;
   bool m_index_was_loaded_from_cache = false;
@@ -516,6 +515,10 @@
 private:
   SymbolFileCommon(const SymbolFileCommon &) = delete;
   const SymbolFileCommon &operator=(const SymbolFileCommon &) = delete;
+
+  /// Do not use m_symtab directly, as it may be freed. Use GetSymtab()
+  /// to access it instead.
+  Symtab *m_symtab = nullptr;
 };
 
 } // namespace lldb_private


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D141165.487003.patch
Type: text/x-patch
Size: 1962 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/lldb-commits/attachments/20230106/aa19b6e2/attachment.bin>