This is the mail archive of the
gdb-patches@sourceware.org
mailing list for the GDB project.
[PATCH v2] Fix read after xfree in linux_nat_detach
On Wed, 22 Mar 2017 17:26:27 +0000
Pedro Alves <palves@redhat.com> wrote:
> On 03/22/2017 05:16 PM, Philipp Rudo wrote:
>
> > Looks like we can get simply rid of it. I'll see that I get a test
> > case running which forks to verify it, tomorrow.
>
> This forks handling is the support for the "checkpoint" &
> friends commands, covered by gdb.base/checkpoint.exp.
> Doesn't seem to exercise detach yet though, unfortunately.
I double checked, the same bug also happens when checkpointing. The
fix now is simply to remove delete_lwp at the end of linux_nat_detach.
Although testing detach would be good, I'm not sure if the testsuite
would have found this bug.
---
From ee3dced0b22cc1edb10a82aeb79ae35d78d665bc Mon Sep 17 00:00:00 2001
From: Philipp Rudo <prudo@linux.vnet.ibm.com>
Date: Wed, 22 Mar 2017 13:53:50 +0100
Subject: [PATCH v2] Fix read after xfree in linux_nat_detach
At the end of linux_nat_detach the main_lwp is deleted (delete_lwp).
This is problematic as during detach (detach_one_lwp and
linux_fork_detach) main_lwp already gets freed. Thus calling
delete_lwp causes a read after free. Fix it by removing the
unnecessary delete_lwp.
gdb/ChangeLog:
* linux-nat.c (linux_nat_detach): delete_lwp causes read after
free. Remove it.
---
gdb/linux-nat.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/gdb/linux-nat.c b/gdb/linux-nat.c
index dff0da5..efe7daf 100644
--- a/gdb/linux-nat.c
+++ b/gdb/linux-nat.c
@@ -1549,7 +1549,6 @@ linux_nat_detach (struct target_ops *ops, const
char *args, int from_tty)
inf_ptrace_detach_success (ops);
}
- delete_lwp (main_lwp->ptid);
}
/* Resume execution of the inferior process. If STEP is nonzero,
--
2.8.4