sarah-walker-pcem / pcem

PCem
http://pcem-emulator.co.uk
GNU General Public License v2.0
1.47k stars 204 forks source link

Use after free during shutdown #187

Open MarekKnapek opened 1 year ago

MarekKnapek commented 1 year ago

Describe the bug A clear and concise description of what the bug is.

When shutting down the emulator, use after free type of bug is triggered.

To Reproduce Steps to reproduce the behavior:

  1. Get pcem from sources.
  2. Compile and link and run debug version.
  3. Create new IBM PC style computer with MDA and fixed disk adapter.
  4. Run the computer. (Probably not needed: Install MS-DOS 5.0 to hard drive from 5.25 floppies.)
  5. Shut down the computer.
  6. Shut down the emulator.
  7. CRASH

Expected behavior A clear and concise description of what you expected to happen.

No crash.

Screenshots If applicable, add screenshots to help explain your problem.

Emulator configuration

Host machine

Additional context Add any other context about the problem here.

Crash happens with following stack:

    #0 0x11c4c77 in readmembl C:\dev\repos\pcem\src\memory\mem.c:446
    #1 0x11085ed in readmemb C:\dev\repos\pcem\src\cpu\808x.c:58
    #2 0x10f9794 in dumpregs C:\dev\repos\pcem\src\cpu\808x.c:551
    #3 0x14848af in closepc C:\dev\repos\pcem\src\pc.c:575
    #4 0x1439d34 in wx_stop C:\dev\repos\pcem\src\wx-ui\wx-sdl2.c:636
    #5 0x1431bc8 in Frame::Quit C:\dev\repos\pcem\src\wx-ui\wx-app.cc:190
    #6 0x1431b0e in Frame::ShowConfigSelection C:\dev\repos\pcem\src\wx-ui\wx-app.cc:106

Memory was deallocated with following stack:

    #2 0x1309ba5 in mda_close C:\dev\repos\pcem\src\video\vid_mda.c:283
    #3 0x1490cea in device_close_all C:\dev\repos\pcem\src\plugin-api\device.c:40
    #4 0x1439cd1 in stop_emulation C:\dev\repos\pcem\src\wx-ui\wx-sdl2.c:617
    #5 0x14316fe in Frame::OnStopEmulationEvent C:\dev\repos\pcem\src\wx-ui\wx-app.cc:131

Memory was allocated with following stack:

    #1 0x1309a60 in mda_standalone_init C:\dev\repos\pcem\src\video\vid_mda.c:234
    #2 0x1490587 in pcem_add_device C:\dev\repos\pcem\src\plugin-api\device.c:310
    #3 0x1490b3b in device_add C:\dev\repos\pcem\src\plugin-api\device.c:32
    #4 0x142a556 in video_init C:\dev\repos\pcem\src\video\video.c:907
    #5 0x1484aad in resetpchard C:\dev\repos\pcem\src\pc.c:363
    #6 0x1439b39 in start_emulation C:\dev\repos\pcem\src\wx-ui\wx-sdl2.c:567
    #7 0x1431aff in Frame::ShowConfigSelection C:\dev\repos\pcem\src\wx-ui\wx-app.cc:104

The problem is, that many things create new mappings, but do not clean them when done. During emulator shutdown (in debug mode only) there is some kind of memory dump, but the dumping procedure is using mappings that no longer exist.

I created fix for my use case, meaning: I added unmap function and fixed the MDA and FDA problems. You can see this on my branch at https://github.com/MarekKnapek/pcem/tree/unmapping but there is more work to be done: Fix all other devices (or remove memory dump at shutdown).

Best regards, Marek.