http://bugs.winehq.org/show_bug.cgi?id=60350 Bug ID: 60350 Summary: ntdll: DW_CFA_GNU_args_size operand is not consumed, so the CFA decoder desynchronises and the unwind overflows the stack Product: Wine Version: 11.16 Hardware: x86-64 OS: Linux Status: UNCONFIRMED Severity: major Priority: P2 Component: ntdll Assignee: wine-bugs@list.winehq.org Reporter: thomas.rapolani@gmail.com Target Milestone: --- Distribution: --- 0x2e is DW_CFA_GNU_args_size, an ordinary GCC extension that carries a ULEB128 operand. dlls/ntdll/unix/dwarf.h has no case for it, and the default branch FIXME( "%lx: unknown CFA opcode %02x\n", info->ip, op ); warns and breaks WITHOUT consuming the operand. The ULEB128 that follows is therefore decoded as the next opcode, every instruction after it is nonsense, and the unwind runs away until the stack is gone. Still present in current master (f8b1ce3): there is no case for 0x2e, and that FIXME is still the only handler it reaches. HOW IT WAS FOUND On a headless Linux audio appliance running Wine 11.16 (Staging), removing a VST3 plug-in while its editor is open. The plug-in and the host are both Unix-built modules compiled by GCC, so their CFI contains DW_CFA_GNU_args_size. removed() entering on thread 04d4 1260 x execute_cfa_instructions: unknown CFA opcode 2e / 20 virtual_setup_exception stack overflow 1792 bytes thread 04d4 silent for the remaining 2.1 million log lines The 0x20 in that line is not a real opcode: it is the desynchronised decoder reading the operand byte of the preceding 0x2e. The thread running the plug-in's own teardown dies, and the process that called into it waits on its socket forever. It is not a deadlock -- the thread is gone. SUGGESTED FIX Add the three GNU opcodes (DW_CFA_GNU_window_save 0x2d, DW_CFA_GNU_args_size 0x2e, DW_CFA_GNU_negative_offset_extended 0x2f) and consume their operands. While there: DW_CFA_val_offset (0x14) and DW_CFA_val_offset_sf (0x15) are already #defined in this header, carry two operands each, and are not handled in the switch either -- so they desynchronise the decoder in exactly the same way if they ever appear. A patch against current master exists and will follow as a merge request on gitlab.winehq.org referencing this bug. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.