[Bug 60350] New: ntdll: DW_CFA_GNU_args_size operand is not consumed, so the CFA decoder desynchronises and the unwind overflows the stack

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60350

            Bug ID: 60350
           Summary: ntdll: DW_CFA_GNU_args_size operand is not consumed,
                    so the CFA decoder desynchronises and the unwind
                    overflows the stack
           Product: Wine
           Version: 11.16
          Hardware: x86-64
                OS: Linux
            Status: UNCONFIRMED
          Severity: major
          Priority: P2
         Component: ntdll
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---
      Distribution: ---

0x2e is DW_CFA_GNU_args_size, an ordinary GCC extension that carries a ULEB128
operand. dlls/ntdll/unix/dwarf.h has no case for it, and the default branch

    FIXME( "%lx: unknown CFA opcode %02x\n", info->ip, op );

warns and breaks WITHOUT consuming the operand. The ULEB128 that follows is
therefore decoded as the next opcode, every instruction after it is nonsense,
and the unwind runs away until the stack is gone.

Still present in current master (f8b1ce3): there is no case for 0x2e, and that
FIXME is still the only handler it reaches.

HOW IT WAS FOUND

On a headless Linux audio appliance running Wine 11.16 (Staging), removing a
VST3 plug-in while its editor is open. The plug-in and the host are both
Unix-built modules compiled by GCC, so their CFI contains DW_CFA_GNU_args_size.

    removed() entering on thread 04d4
    1260 x  execute_cfa_instructions: unknown CFA opcode 2e / 20
    virtual_setup_exception stack overflow 1792 bytes
    thread 04d4 silent for the remaining 2.1 million log lines

The 0x20 in that line is not a real opcode: it is the desynchronised decoder
reading the operand byte of the preceding 0x2e. The thread running the
plug-in's own teardown dies, and the process that called into it waits on its
socket forever. It is not a deadlock -- the thread is gone.

SUGGESTED FIX

Add the three GNU opcodes (DW_CFA_GNU_window_save 0x2d, DW_CFA_GNU_args_size
0x2e, DW_CFA_GNU_negative_offset_extended 0x2f) and consume their operands.

While there: DW_CFA_val_offset (0x14) and DW_CFA_val_offset_sf (0x15) are
already #defined in this header, carry two operands each, and are not handled
in the switch either -- so they desynchronise the decoder in exactly the same
way if they ever appear.

A patch against current master exists and will follow as a merge request on
gitlab.winehq.org referencing this bug.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.