Questionably needed clarification for an LLM-reported issue. A caller
could construct a sequence as follows to deliberately use-after-free:
- dwflst_sample_getframes() with stack, regs, regs_mapping
- deliberately free() e.g. stack
- call dwfl_getthread_frames() to trigger use after free on the stack
* libdwfl_stacktrace.h (dwflst_sample_getframes): Comment hints LLM
not to do the silly thing.
(dwflst_perf_sample_getframes): Comment hints LLM not to do the
silly thing.
---
libdwfl_stacktrace/libdwfl_stacktrace.h | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)
diff --git a/libdwfl_stacktrace/libdwfl_stacktrace.h
b/libdwfl_stacktrace/libdwfl_stacktrace.h
index 2f4e9164..a3e779b9 100644
--- a/libdwfl_stacktrace/libdwfl_stacktrace.h
+++ b/libdwfl_stacktrace/libdwfl_stacktrace.h
@@ -119,10 +119,13 @@ extern int dwflst_tracker_linux_proc_find_elf
(Dwfl_Module *mod, void **userdata
REGS_MAPPING array specifies its position in the full register file
expected by the DWARF infrastructure. Calls dwfl_attach_state on
DWFL, with architecture specified by ELF, ELF must remain vaild
- during Dwfl lifetime. Returns zero if all frames have been
- processed by the callback, returns -1 on error, or the value of the
- callback when not DWARF_CB_OK. -1 returned on error will set
- dwfl_errno (). */
+ during Dwfl lifetime. The callbacks_arg provided to dwfl_attach_state
+ retains transient pointers to STACK, REGS, REGS_MAPPING, cleared
+ by the next call to dwflst_sample_getframes.
+
+ Returns zero if all frames have been processed by the callback,
+ returns -1 on error, or the value of the callback when not
+ DWARF_CB_OK. -1 returned on error will set dwfl_errno (). */
int dwflst_sample_getframes (Dwfl *dwfl, Elf *elf, pid_t pid, pid_t tid,
const void *stack, size_t stack_size,
const Dwarf_Word *regs, uint32_t n_regs,
@@ -134,10 +137,13 @@ int dwflst_sample_getframes (Dwfl *dwfl, Elf *elf, pid_t
pid, pid_t tid,
/* Adapts dwflst_sample_getframes to linux perf_events stack sample
and register file data format. Calls dwfl_attach_state on DWFL,
with architecture specified by ELF, ELF must remain valid during
- Dwfl lifetime. Returns zero if all frames have been processed by
- the callback, returns -1 on error, or the value of the callback
- when not DWARF_CB_OK. -1 returned on error will set dwfl_errno
- (). */
+ Dwfl lifetime. The callbacks_arg provided to dwfl_attach_state
+ retains transient pointers to STACK, REGS, REGS_MAPPING,
+ cleared by the next call to dwflst_sample_getframes.
+
+ Returns zero if all frames have been processed by the callback,
+ returns -1 on error, or the value of the callback when not
+ DWARF_CB_OK. -1 returned on error will set dwfl_errno (). */
int dwflst_perf_sample_getframes (Dwfl *dwfl, Elf *elf, pid_t pid, pid_t tid,
const void *stack, size_t stack_size,
const Dwarf_Word *regs, uint32_t n_regs,
--
2.54.0
