[PATCH] Fix read after xfree in linux_nat_detach

[Philipp Rudo <prudo@linux.vnet.ibm.com>]

At the end of linux_nat_detach there is a check whether the inferior has a
fork.  If no fork exists the main_lwp is detached (detach_one_lwp) and
later, outside the check, deleted (delete_lwp).  This is problematic as
detach_one_lwp also calls delete_lwp freeing main_lwp.  Thus the second
call to delete_lwp reads from already freed memory.  Fix this by removing
delete_lwp at the end of detach_one_lwp.

gdb/ChangeLog:
	* linux-nat.c (detach_one_lwp): Remove call to delete_lwp.
	(detach_callback): Add call to delete_lwp and rename ...
	(detach_and_delete_callback): ... to this.
	(linux_nat_detach): Adjust.
---
 gdb/linux-nat.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/gdb/linux-nat.c b/gdb/linux-nat.c
index 73ef2d4..b578f69 100644
--- a/gdb/linux-nat.c
+++ b/gdb/linux-nat.c
@@ -1483,18 +1483,19 @@ detach_one_lwp (struct lwp_info *lp, int *signo_p)
 			  target_pid_to_str (lp->ptid),
 			  strsignal (signo));
     }
-
-  delete_lwp (lp->ptid);
 }
 
 static int
-detach_callback (struct lwp_info *lp, void *data)
+detach_and_delete_callback (struct lwp_info *lp, void *data)
 {
   /* We don't actually detach from the thread group leader just yet.
      If the thread group exits, we must reap the zombie clone lwps
      before we're able to reap the leader.  */
   if (ptid_get_lwp (lp->ptid) != ptid_get_pid (lp->ptid))
-    detach_one_lwp (lp, NULL);
+    {
+      detach_one_lwp (lp, NULL);
+      delete_lwp (lp->ptid);
+    }
   return 0;
 }
 
@@ -1516,7 +1517,7 @@ linux_nat_detach (struct target_ops *ops, const char *args, int from_tty)
      they're no longer running.  */
   iterate_over_lwps (pid_to_ptid (pid), stop_wait_callback, NULL);
 
-  iterate_over_lwps (pid_to_ptid (pid), detach_callback, NULL);
+  iterate_over_lwps (pid_to_ptid (pid), detach_and_delete_callback, NULL);
 
   /* Only the initial process should be left right now.  */
   gdb_assert (num_lwps (ptid_get_pid (inferior_ptid)) == 1);
-- 
2.8.4