From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Gerd =?UTF-8?Q?M=C3=B6llmann?= Newsgroups: gmane.emacs.bugs Subject: bug#58042: 29.0.50; ASAN use-after-free in re_match_2_internal Date: Sat, 24 Sep 2022 17:08:12 +0200 Message-ID: References: <835yhcom6g.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="16603"; mail-complaints-to="usenet@ciao.gmane.io" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/29.0.50 (darwin) Cc: 58042@debbugs.gnu.org To: Eli Zaretskii Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sat Sep 24 17:09:14 2022 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oc6mH-00047x-Pk for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 24 Sep 2022 17:09:13 +0200 Original-Received: from localhost ([::1]:52526 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oc6mG-0000sJ-RO for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 24 Sep 2022 11:09:12 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:52536) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oc6m6-0000s6-OL for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 11:09:03 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:45885) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1oc6m6-00083P-FI for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 11:09:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1oc6m5-0005RS-VO for bug-gnu-emacs@gnu.org; Sat, 24 Sep 2022 11:09:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Gerd =?UTF-8?Q?M=C3=B6llmann?= Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 24 Sep 2022 15:09:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 58042 X-GNU-PR-Package: emacs Original-Received: via spool by 58042-submit@debbugs.gnu.org id=B58042.166403210820876 (code B ref 58042); Sat, 24 Sep 2022 15:09:01 +0000 Original-Received: (at 58042) by debbugs.gnu.org; 24 Sep 2022 15:08:28 +0000 Original-Received: from localhost ([127.0.0.1]:44963 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oc6lR-0005QX-5t for submit@debbugs.gnu.org; Sat, 24 Sep 2022 11:08:28 -0400 Original-Received: from mail-ed1-f41.google.com ([209.85.208.41]:44938) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1oc6lP-0005QL-Sr for 58042@debbugs.gnu.org; Sat, 24 Sep 2022 11:08:20 -0400 Original-Received: by mail-ed1-f41.google.com with SMTP id x21so3688287edd.11 for <58042@debbugs.gnu.org>; Sat, 24 Sep 2022 08:08:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:from:to:cc:subject:date; bh=xQ9o9Yjwujb98WNo8RZOkCmDGb708zY/0j/dSnxyLEA=; b=gnjgEvVCW5sj7/xt1TQBEanaVVQUORF69W+KmTzLOKuDM04itRbcDOdNcNzqX1oomS QLWB/KYVPdWpsiIRTyN4YtzYCtvaoZzo3OyzUpgLet+oucQR4kPKcYEEtOSxpeetBgT2 c2vM4amZ8Nqvf0d/qQW0AQcftCMw3KUnAQQcuEjmjCH5Ars9NjfwZ4fTwLJLS2RbJl8r pJWmLibd2sHrxL7wzsM8Y7sXzYdyjh6YzFzW4VV3MWgy5hd5KfWAuPF1iPabStSnx9P+ S5ds2E2NsQz7XO/myqesOm6sSYvN+RsUsv1yg/8+Bpk4T1uvRewjWJgnGUpgGyGUWtSw htfw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:user-agent:message-id:date :references:in-reply-to:subject:cc:to:from:x-gm-message-state:from :to:cc:subject:date; bh=xQ9o9Yjwujb98WNo8RZOkCmDGb708zY/0j/dSnxyLEA=; b=KZPEoKZkgYZwfyJUo26GNw4sfiUtN1BuUO3w3d91zjA7gZTFG5eyz95eGk7Rgs7zPe ZSaxfDXFibgBXaFOgalKsHffsevNhJ0CH+a3xecASD3czOIiP0X5IOsAThlYEdpU9Mlc inb0wgEkvErhT/czf/PiFAo9MiPQRrBf8bjEWAMn1IgqwodpPy9xiSHa0m48nijMLPYg QWUTKqhHg9+UnGIPtjQ5Fhr3WJklvHRfbqAPehaMe6Rg7EH9ytghg3esJk5uliF0Q6b9 DvIGvPpDZs8dsCgnmlsmCJx1p3b5mgwY/vpD91q3gyjqJOYFyjnLGyvuy6CaxKFvlolZ KNUA== X-Gm-Message-State: ACrzQf1xuZkNiohDNEGDQvE5fqocxEBNyV9Gh/LrxGlSmllHh+B0qkJG 7Xp59KlVR8HsDvRnoA7HL0Gx5Gvu7qw= X-Google-Smtp-Source: AMsMyM50ueqdY63ND3km4yRc2RJxkEqbMxbu/wa2wZmAfrdn5DH8Rqp+juOfFEZQucpIu2nYQYNTKg== X-Received: by 2002:a05:6402:2711:b0:451:327a:365f with SMTP id y17-20020a056402271100b00451327a365fmr13414649edd.315.1664032093603; Sat, 24 Sep 2022 08:08:13 -0700 (PDT) Original-Received: from Mini.fritz.box (p4fe3a935.dip0.t-ipconnect.de. [79.227.169.53]) by smtp.gmail.com with ESMTPSA id j1-20020a17090623e100b0077a201f6d1esm5493141ejg.87.2022.09.24.08.08.12 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 24 Sep 2022 08:08:12 -0700 (PDT) In-Reply-To: <835yhcom6g.fsf@gnu.org> (Eli Zaretskii's message of "Sat, 24 Sep 2022 17:56:55 +0300") X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:243543 Archived-At: Eli Zaretskii writes: >> From: Gerd M=C3=B6llmann >> Date: Sat, 24 Sep 2022 16:17:20 +0200 >>=20 >> Gerd M=C3=B6llmann writes: >>=20 >> > =3D=3D79227=3D=3DERROR: AddressSanitizer: heap-use-after-free on addre= ss >> > 0x00011f81e7d1 at pc 0x0001005825c4 bp 0x00016fdcf370 sp >> > 0x00016fdcf368 >> > READ of size 1 at 0x00011f81e7d1 thread T0 >> > #0 0x1005825c0 in re_match_2_internal regex-emacs.c:4352 >> > #1 0x10057e5cc in rpl_re_search_2 regex-emacs.c:3383 >> > #2 0x10057d1c4 in rpl_re_search regex-emacs.c:3177 >> > #3 0x10056115c in fast_string_match_internal search.c:492 >> > #4 0x1005045c0 in fast_string_match lisp.h:4818 >> > #5 0x100504018 in Ffind_file_name_handler fileio.c:324 >> > #6 0x1006dbe5c in openp lread.c:1911 >> > #7 0x1006d8844 in Fload lread.c:1302 >> > #8 0x1006e1af0 in save_match_data_load lread.c:1630 >> > #9 0x10064f8cc in load_with_autoload_queue eval.c:2269 >> > #10 0x10067d2f8 in Frequire fns.c:3274 >>=20 >> Forget to copy the part where it is freed: >>=20 >> freed by thread T0 here: >> #0 0x103332de4 in wrap_free+0x98 (libclang_rt.asan_osx_dynamic.dylib= :arm64e+0x3ede4) >> #1 0x100985e38 in rpl_free free.c:48 >> #2 0x1005b71a4 in lisp_free alloc.c:1038 >> #3 0x1005cbda4 in compact_small_strings alloc.c:2191 >> #4 0x1005c9f24 in sweep_strings alloc.c:2072 >> #5 0x1005bd028 in gc_sweep alloc.c:7397 >> #6 0x1005bb178 in garbage_collect alloc.c:6245 >> #7 0x1005ba694 in maybe_garbage_collect alloc.c:6090 >> #8 0x1006505ac in maybe_gc lisp.h:5624 >> #9 0x100648ffc in Ffuncall eval.c:2972 >> #10 0x10064bcd0 in internal_condition_case_n eval.c:1555 >> #11 0x1000cdc8c in safe__call xdisp.c:3026 >> #12 0x1000cdfc4 in safe__call1 xdisp.c:3062 >> #13 0x1001d6404 in prepare_menu_bars xdisp.c:13572 >> #14 0x1000f2340 in redisplay_internal xdisp.c:16523 >> #15 0x100108f34 in redisplay xdisp.c:16105 >> #16 0x10088fa84 in -[EmacsView layoutSublayersOfLayer:] nsterm.m:8662 >> #17 0x1900a9624 in CA::Layer::layout_if_needed(CA::Transaction*)+0x2= 24 (QuartzCore:arm64e+0x20624) >> #18 0x1901f661c in >> CA::Context::commit_transaction(CA::Transaction*, double, >> double*)+0x1c0 (QuartzCore:arm64e+0x16d61c) >> #19 0x19008b4c8 in CA::Transaction::commit()+0x2bc (QuartzCore:arm64= e+0x24c8) >> #20 0x18bee1698 in __62+[CATransaction(NSCATransaction) >> NS_setFlushesWithDisplayLink]_block_invoke+0x12c >> (AppKit:arm64e+0x1ac698) >> #21 0x18c646754 in ___NSRunLoopObserverCreateWithHandler_block_invok= e+0x3c (AppKit:arm64e+0x911754) >> #22 0x1892101a0 in >> __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__+0x20 >> (CoreFoundation:arm64e+0x841a0) >> #23 0x18920fff0 in __CFRunLoopDoObservers+0x24c (CoreFoundation:arm6= 4e+0x83ff0) >> #24 0x18920f524 in __CFRunLoopRun+0x300 (CoreFoundation:arm64e+0x835= 24) >> #25 0x18920ea80 in CFRunLoopRunSpecific+0x254 (CoreFoundation:arm64e= +0x82a80) >> #26 0x191e4e334 in RunCurrentEventLoopInMode+0x120 (HIToolbox:arm64e= +0x32334) >> #27 0x191e4dfc0 in ReceiveNextEventCommon+0x140 (HIToolbox:arm64e+0x= 31fc0) >> #28 0x191e4de64 in _BlockUntilNextEventMatchingListInModeWithFilter+= 0x44 (HIToolbox:arm64e+0x31e64) >> #29 0x18bd76518 in _DPSNextEvent+0x358 (AppKit:arm64e+0x41518) > > So it was freed by GC, which probably relocated string data or > something. But I don't understand the relation between these two > backtraces: was the one that accessed a freed string called by the one > which triggered GC? IOW, what is the relation between the call to > 'require', which ended up calling re_match_2_internal, and the call to > prepare_menu_bars, which triggered GC? I don't understand that part either. > re_search gets Lisp strings as its arguments, so unless GC was called > while the regexp search was in progress, I cannot understand how this > could happen. Right, that's what I also think. See also my other mail. > Is there any way to know which argument of re_match_2_internal was > used to access the free'd heap? I can't figure it out from the code, and LLDB got the segmentation fault, so I can't look. Maybe Stefan can figure that out. But in general, I think the small string compaction could be a serious problem here, as soon as a GC happens while the regexp machine holds pointers.