https://sourceware.org/bugzilla/show_bug.cgi?id=34579
--- Comment #1 from Serhei Makarov <serhei at serhei dot io> --- Comment on attachment 16971 --> https://sourceware.org/bugzilla/attachment.cgi?id=16971 Detailed lifecycle analysis and native x86_64/AArch64 reproduction of post-return caller-buffer use-after-free in dwflst_sample_getframes(). So if I understand correctly, the reproducer is - call dwflst_sample_getframes() with stack, regs - deliberately free stack - call dwfl_getthread_frames(), which reuses the callbacks set up by sample_getframes Options 1. do-nothing 2. change the dwflst_sample_getframes comment to document this 3. zero out the callbacks_arg at the end of dwflst_sample_getframes() I've drafted a patch for option 2. Not really happy because an LLM constructed this sequence, so there is no actual user confusion that justifies the importance of this clarification. I can implement option 3 if mjw or amerey think it's needed. -- You are receiving this mail because: You are on the CC list for the bug.
