This is the mail archive of the
gdb@sourceware.org
mailing list for the GDB project.
linux-thread-db.c not only caller of add_thread, -> gdb segv
- From: "Douglas Evans" <dje at google dot com>
- To: gdb at sourceware dot org
- Date: Thu, 8 Nov 2007 20:38:13 -0800
- Subject: linux-thread-db.c not only caller of add_thread, -> gdb segv
Hi. I'm trying to decide what's the best way to fix a bug I've found.
linux-thread-db.c is not the only caller of add_thread, e.g. infrun.c
calls it too.
linux-thread-db.c assumes thread_info.private is non-NULL, e.g. here:
static int
clear_lwpid_callback (struct thread_info *thread, void *dummy)
{
/* If we know that our thread implementation is 1-to-1, we could
save
a certain amount of information; it's not clear how much, so we
are always conservative. */
thread->private->th_valid = 0;
thread->private->ti_valid = 0;
return 0;
}
called from here:
#0 0x00000000004681a4 in clear_lwpid_callback (thread=0xb132d0,
dummy=0x0) at ../../src/gdb/linux-thread-db.c:765
#1 0x00000000004f8480 in iterate_over_threads (callback=0x46818d
<clear_lwpid_callback>, data=0x0) at ../../src/gdb/thread.c:204
#2 0x00000000004682a6 in thread_db_resume (ptid={pid = -1, lwp = 0,
tid = 0}, step=0, signo=TARGET_SIGNAL_0) at
../../src/gdb/linux-thread-db.c:782
#3 0x00000000004eb83d in resume (step=0, sig=TARGET_SIGNAL_0) at
../../src/gdb/infrun.c:614
#4 0x00000000004ebc14 in proceed (addr=18446744073709551615,
siggnal=TARGET_SIGNAL_DEFAULT, step=0) at ../../src/gdb/infrun.c:805
This is iterating over all threads, some of which were created via
add_thread calls outside of linux-thread-db.c, and thus
thread_info.private is NULL and boom, segv.
I can see two solutions
1) ensure all calls to add_thread properly initialize thread_info.private
(via callback or whatever)
2) have linux-thread-db.c always check thread_info.private before
dereferencing it.
Comments?