Re: [PATCH v2] Fix read after xfree in linux_nat_detach

[Pedro Alves <palves@redhat.com>]

OK.

On 03/23/2017 01:17 PM, Philipp Rudo wrote:
> On Wed, 22 Mar 2017 17:26:27 +0000
> Pedro Alves <palves@redhat.com> wrote:
> 
>> On 03/22/2017 05:16 PM, Philipp Rudo wrote:
>>
>>> Looks like we can get simply rid of it.  I'll see that I get a test
>>> case running which forks to verify it, tomorrow.  
>>
>> This forks handling is the support for the "checkpoint" & 
>> friends commands, covered by gdb.base/checkpoint.exp.
>> Doesn't seem to exercise detach yet though, unfortunately.
> 
> I double checked, the same bug also happens when checkpointing.  The
> fix now is simply to remove delete_lwp at the end of linux_nat_detach.
> 
> Although testing detach would be good, I'm not sure if the testsuite
> would have found this bug.
> 
> ---
> 
> From ee3dced0b22cc1edb10a82aeb79ae35d78d665bc Mon Sep 17 00:00:00 2001
> From: Philipp Rudo <prudo@linux.vnet.ibm.com>
> Date: Wed, 22 Mar 2017 13:53:50 +0100
> Subject: [PATCH v2] Fix read after xfree in linux_nat_detach
> 
> At the end of linux_nat_detach the main_lwp is deleted (delete_lwp).
> This is problematic as during detach (detach_one_lwp and
> linux_fork_detach) main_lwp already gets freed.  Thus calling
> delete_lwp causes a read after free.  Fix it by removing the
> unnecessary delete_lwp.
> 
> gdb/ChangeLog:
> 	* linux-nat.c (linux_nat_detach): delete_lwp causes read after
> free. Remove it.
> ---
>  gdb/linux-nat.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/gdb/linux-nat.c b/gdb/linux-nat.c
> index dff0da5..efe7daf 100644
> --- a/gdb/linux-nat.c
> +++ b/gdb/linux-nat.c
> @@ -1549,7 +1549,6 @@ linux_nat_detach (struct target_ops *ops, const
> char *args, int from_tty) 
>        inf_ptrace_detach_success (ops);
>      }
> -  delete_lwp (main_lwp->ptid);
>  }
>  
>  /* Resume execution of the inferior process.  If STEP is nonzero,
> 


-- 
Thanks,
Pedro Alves