[Bug 60351] New: ntdll: a DWARF personality routine is called as an SEH handler, causing 252 nested faults and a dead thread

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60351

            Bug ID: 60351
           Summary: ntdll: a DWARF personality routine is called as an SEH
                    handler, causing 252 nested faults and a dead thread
           Product: Wine
           Version: 11.16
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: major
          Priority: P2
         Component: ntdll
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

When the exception dispatcher unwinds a frame of a Unix-built module through
the
DWARF unwinder, dlls/ntdll/unix/signal_x86_64.c copies the personality routine
out of the frame's CIE into dispatch->LanguageHandler, and the PE-side
virtual_unwind() keeps it whenever the address belongs to a loaded module. The
dispatcher then calls it as an SEH handler: MS ABI, four arguments, an
EXCEPTION_DISPOSITION back.

The routine is __gxx_personality_v0 from the host's libstdc++: SysV ABI, five
arguments, an _Unwind_Reason_Code back. The two are not interchangeable.

Still present in current master (f8b1ce3): dlls/ntdll/signal_x86_64.c:118 is
still "if (!status && dispatch->LanguageHandler && !module)".

HOW IT WAS FOUND

On a headless Linux audio appliance running Wine 11.16 (Staging), removing a
VST3 plug-in while its editor is open. The module in the trace below is a
winelib module linked against the system libstdc++, which is what makes it
reachable; the plug-in raises an access violation inside its own teardown.

    seh handler call #6: handler 79456EBE4A80 (libstdc++.so.6) frame 10f3a0
                         pc 79456ef24720 (yabridge-host.exe.so) -> 3

3 is _URC_FATAL_PHASE1_ERROR to libstdc++ -- the version argument it received
was not 1, because it was called with the wrong ABI -- and the same 3 is
ExceptionCollidedUnwind to call_seh_handlers(). The collided-unwind path then
re-unwinds that frame with RtlVirtualUnwind(), which has no PE unwind
information for it and takes the leaf-function fallback:

    rip = *rsp, rsp += 8, call the handler again, get 3 again

a word at a time up the stack, past its top, until the read faults. Dispatching
that fault walks the same frame and does the same thing. 252 nested access
violations later the guard page is hit and the thread dies of stack overflow.

Any winelib module linked against the system libstdc++ is exposed to this, not
only the one measured here.

SUGGESTED FIX

Do not carry a DWARF personality routine into dispatch->LanguageHandler for a
frame that has no PE exception information; a SysV personality routine is not
something call_seh_handlers() can call.

A patch against current master exists and will follow as a merge request on
gitlab.winehq.org referencing this bug.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.