panda-re / panda

Platform for Architecture-Neutral Dynamic Analysis
https://panda.re
Other
2.47k stars 476 forks source link

OSI: fix null ptr dereference when current thread is NULL #1405

Closed AndrewFasano closed 8 months ago

AndrewFasano commented 8 months ago

Previously we'd just get a segfault if OSI linux returned NULL as it can do here. This was introduced in #653.

This PR does not update OSI consumers to check if get_current_thread returns NULL, but we're slowly popping the stack on handling this rare condition.

Thread 53 "python3" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f277bc3e700 (LWP 218)]
0x00007f279c23bb29 in get_current_thread () from /usr/local/lib/panda/mipsel/panda_osi.so
(gdb) x/i $pc
=> 0x7f279c23bb29 <get_current_thread+217>:     mov    (%rax),%rdx
(gdb) p $rax
$2 = 0
(gdb) bt
#0  0x00007f279c23bb29 in get_current_thread () from /usr/local/lib/panda/mipsel/panda_osi.so
#1  0x00007f279c138634 in ?? () from /usr/local/lib/panda/mipsel/panda_callstack_instr.so
#2  0x00007f279c1389b8 in before_block_exec () from /usr/local/lib/panda/mipsel/panda_callstack_instr.so
#3  0x00007f2738091733 in panda_callbacks_before_block_exec () from /usr/local/bin/libpanda-mipsel.so
#4  0x00007f27380f9d6b in cpu_exec () from /usr/local/bin/libpanda-mipsel.so
#5  0x00007f273811ca23 in ?? () from /usr/local/bin/libpanda-mipsel.so
#6  0x00007f27b6621609 in start_thread (arg=<optimized out>) at pthread_create.c:477
#7  0x00007f27b675b353 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95