From patchwork Mon Aug 21 10:42:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alan Modra X-Patchwork-Id: 136368 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b82d:0:b0:3f2:4152:657d with SMTP id z13csp2912487vqi; Mon, 21 Aug 2023 03:43:11 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGhgfLACOlGglglj/DfXq2537uiwIu7nk6WrgfqtDqTXsKO8aopAfT1w/4xwS6m13+7xac1 X-Received: by 2002:a17:907:2ccc:b0:99b:cd1a:a453 with SMTP id hg12-20020a1709072ccc00b0099bcd1aa453mr4878331ejc.3.1692614590826; Mon, 21 Aug 2023 03:43:10 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1692614590; cv=none; d=google.com; s=arc-20160816; b=gzTgaTOWgyr5PCdOnddfsGVQQSebuxiCY+NGwrmip9Cg8UAkfB1muAPC4gd7dfzGlt xMAyymO7bJ8D/QYBVrIZZp6xhAf8FG39LdVgd8JERRBFPh1Dt+v93bhSOaI9pRGIPf+4 IuuVbWqbJezsr+YET96RZjsnSCmrGi7cNVQjVk4muVBC6n0aw92H+zwIOrlWW++WZVLk IL+XS096OGN6uTaXR7BnWwaph162fgCyL+DwWmTt6PGJi9RuTU9BVO7uc59FL+dZnzXw Ofmai3IAQLGr4LeUgm3O2K984DSjw3/0vsG9SJ0CLkPIOetqqHuwLyThYLP9UuaHflnq 69LQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:reply-to:from:list-subscribe:list-help:list-post :list-archive:list-unsubscribe:list-id:precedence :content-disposition:mime-version:message-id:subject:to:date :dmarc-filter:delivered-to:dkim-signature:dkim-filter; bh=dl1SQrVhhYOJhg+nleeUbN7ArM6NU3SCVkfsiX59lPQ=; fh=HNIqzTA9Dp00ovCAyCdXfuEvWDT00OlFxFRPLybXRis=; b=p717K9G2rJ1kyh6cqRqGyXfckVvpIw1pPYTAj1Z7fxRSp/D0wzzuGMTq1e8pLaXZnT a37EL5m10500IvjlytTqhNzHrrfoM88cvHIJN5wItjIIUworvlSS/g0DJ51pNFIA8m+E 54B14mFL18PSWcBjSTcJ3DF/O2raAlV4dcp3CjXHe7oaoFU83lkjXd/0Nmymy3DEyWxn Zw4/Qnmpd4zLodgVZSyF+RJ50xBPC1uGvb3Xcr4ArUyl3cbz9EaV6C8d2bYyK2kAls96 Vfn+Z8brUvKaSkMW0vdaDIUBQPJlt2MrqenlPdFiqYjgj11wSouGEbl5pX5+R6wvjcIK okUQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=sM6MJtPY; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from server2.sourceware.org (server2.sourceware.org. [2620:52:3:1:0:246e:9693:128c]) by mx.google.com with ESMTPS id s20-20020a170906961400b009a18ab040a3si2064386ejx.241.2023.08.21.03.43.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Aug 2023 03:43:10 -0700 (PDT) Received-SPF: pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) client-ip=2620:52:3:1:0:246e:9693:128c; Authentication-Results: mx.google.com; dkim=pass header.i=@sourceware.org header.s=default header.b=sM6MJtPY; spf=pass (google.com: domain of binutils-bounces+ouuuleilei=gmail.com@sourceware.org designates 2620:52:3:1:0:246e:9693:128c as permitted sender) smtp.mailfrom="binutils-bounces+ouuuleilei=gmail.com@sourceware.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sourceware.org Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 8078A3857029 for ; Mon, 21 Aug 2023 10:43:09 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 8078A3857029 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1692614589; bh=dl1SQrVhhYOJhg+nleeUbN7ArM6NU3SCVkfsiX59lPQ=; h=Date:To:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=sM6MJtPYa9ogzFaXGtc6HZeohzgU2+Bb1ngWrF0hheRL1NG01LhwuJmZlTR3Ukyze Ye5zY87nMfpKYGzYYJlxXv1Wmgzrqqt8xRDvHV10/U+QyGtAjx6X9kyO8uES6cOZ8n mDYJpAQelmi0hL07zETHPFMwcnLaIVX5bNqHxETw= X-Original-To: binutils@sourceware.org Delivered-To: binutils@sourceware.org Received: from mail-pj1-x1036.google.com (mail-pj1-x1036.google.com [IPv6:2607:f8b0:4864:20::1036]) by sourceware.org (Postfix) with ESMTPS id F06843858298 for ; Mon, 21 Aug 2023 10:43:00 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org F06843858298 Received: by mail-pj1-x1036.google.com with SMTP id 98e67ed59e1d1-26b67b38b61so1806242a91.0 for ; Mon, 21 Aug 2023 03:43:00 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692614579; x=1693219379; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=dl1SQrVhhYOJhg+nleeUbN7ArM6NU3SCVkfsiX59lPQ=; b=gDBohswUP3J4kNHUZAZcBuBhKTSmKvWYJA2bRfrwOwXTKGzB0z6ACuIE5pjb1p8GHP BX8jIxOxQA9EE6zMfeV754cKIljENNIfjX+QcD1odpXwq6lPcxgDF/kgZjv9doeMmlwU ly0VA5cNEgbueas1msSTxFyzKt24LN8QYdIUBoQZk5IPoy1s//bPC0T8hGnA9Lpx+++D gKlueUIkpUoL8B1/lYA0QCvkxNGMGFCrVGzrpjeN78i8iAZwlU0eOUHbicMoUOqPGDIJ /JPTtBnflzuKLXDwaRBhqUk/TJCauzRClXun++JjGCk54eNb5mlRsSXk4NSaN52fiNM8 4OMQ== X-Gm-Message-State: AOJu0YwMJhLQvM2jr5jAX3J2wYylYyqy6C7naOKPA8BAZohPwLQsUWXb bTNAlECzATcqr9UT83vhjWImzh816qU= X-Received: by 2002:a17:90a:4963:b0:269:86ce:c3b5 with SMTP id c90-20020a17090a496300b0026986cec3b5mr3344519pjh.44.1692614579303; Mon, 21 Aug 2023 03:42:59 -0700 (PDT) Received: from squeak.grove.modra.org (158.106.96.58.static.exetel.com.au. [58.96.106.158]) by smtp.gmail.com with ESMTPSA id w11-20020a17090aea0b00b002639c4f81cesm7718784pjy.3.2023.08.21.03.42.58 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 21 Aug 2023 03:42:58 -0700 (PDT) Received: by squeak.grove.modra.org (Postfix, from userid 1000) id BABFD11423E6; Mon, 21 Aug 2023 20:12:55 +0930 (ACST) Date: Mon, 21 Aug 2023 20:12:55 +0930 To: binutils@sourceware.org Subject: bfd_close_all_done bug and bfd_last_cache Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-3034.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: binutils@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Binutils mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: Alan Modra via Binutils From: Alan Modra Reply-To: Alan Modra Errors-To: binutils-bounces+ouuuleilei=gmail.com@sourceware.org Sender: "Binutils" X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1774835037323413298 X-GMAIL-MSGID: 1774835037323413298 bfd_close ought to always call iovec->bclose so that cache_bclose is called. If not, bfd_last_cache will be left pointing at freed memory. This bug was found by oss-fuzz with the trigger being an old bug in the ia64-vms support. Given a file of the "wrong" size, elf64_vms_close_and_cleanup attempted to extend it, leading to an error since the file was opened read-only by nm. nm bad_file bad_file then hit the use-after-free when opening the second file. commit 8219cab3f8 fixed multiple bugs of this type in bfd_close and bfd_close_all_done, but didn't go quite far enough. * elf64-ia64-vms.c (elf64_vms_close_and_cleanup): Don't attempt to extend read-only files. * opncls.c (bfd_close_all_done): Always call _close_and_cleanup. An old bug in the ia64-vms support can be used to tickle another bug in bfd_close_all_done. If _close_and_cleanup returns an error, diff --git a/bfd/elf64-ia64-vms.c b/bfd/elf64-ia64-vms.c index f8e9922fc4a..ab1f18b8d81 100644 --- a/bfd/elf64-ia64-vms.c +++ b/bfd/elf64-ia64-vms.c @@ -4713,7 +4713,8 @@ static bool elf64_vms_close_and_cleanup (bfd *abfd) { bool ret = true; - if (bfd_get_format (abfd) == bfd_object) + if (bfd_get_format (abfd) == bfd_object + && bfd_write_p (abfd)) { long isize; diff --git a/bfd/opncls.c b/bfd/opncls.c index 56a90046b1a..741d20e81da 100644 --- a/bfd/opncls.c +++ b/bfd/opncls.c @@ -920,13 +920,11 @@ bfd_close_all_done (bfd *abfd) { bool ret = BFD_SEND (abfd, _close_and_cleanup, (abfd)); - if (ret && abfd->iovec != NULL) - { - ret = abfd->iovec->bclose (abfd) == 0; + if (abfd->iovec != NULL) + ret &= abfd->iovec->bclose (abfd) == 0; - if (ret) - _maybe_make_executable (abfd); - } + if (ret) + _maybe_make_executable (abfd); _bfd_delete_bfd (abfd); free (_bfd_error_buf);