Update address space of map if it changes.
In debuggerd, a single BacktraceMap is created that is used to unwind
all of the threads in the process. Unfortunately, the address space
data can be cached in the libunwind copy of the map data. However, the
address space is only valid in the Backtrace object and does not survive
across unwinds. This can lead to a crash when a cached map that is only
present in memory tries to access the already destroyed address space.
The fix is to update the address space, if necessary, whenever a
cached map that only exists in memory is about to be used.
Bug: 28210681
Change-Id: I3cedb043aed499f3eb27f9838d040be77dc92d9a
diff --git a/src/elfxx.h b/src/elfxx.h
index 38aa079..bc878c0 100644
--- a/src/elfxx.h
+++ b/src/elfxx.h
@@ -211,6 +211,11 @@
if (map->ei.valid && elf_w (get_load_base) (&map->ei, map->offset, &load_base)) {
map->load_base = load_base;
}
+ } else if (map->ei.valid && !map->ei.mapped && map->ei.u.memory.as != as) {
+ // If this map is only in memory, this might be a cached map
+ // that crosses over multiple unwinds. In this case, we've detected
+ // that the as is stale, so set it to a valid as.
+ map->ei.u.memory.as = as;
}
lock_release (&map->ei_lock, saved_mask);
return map->ei.valid;
