Re: [PATCH] Fix read after xfree in linux_nat_detach

[Philipp Rudo <prudo@linux.vnet.ibm.com>]

On Wed, 22 Mar 2017 15:07:22 +0000
Pedro Alves <palves@redhat.com> wrote:

> On 03/22/2017 01:11 PM, Philipp Rudo wrote:
> > At the end of linux_nat_detach there is a check whether the
> > inferior has a fork.  If no fork exists the main_lwp is detached
> > (detach_one_lwp) and later, outside the check, deleted
> > (delete_lwp).  This is problematic as detach_one_lwp also calls
> > delete_lwp freeing main_lwp.  Thus the second call to delete_lwp
> > reads from already freed memory.  Fix this by removing delete_lwp
> > at the end of detach_one_lwp.  
> 
> Why not just move that unconditional call to delete_lwp call at
> the end of linux_nat_detach to the forks_exist_p/true branch?

That was the first idea I had.  But I decided that it would be better
for both detach functions (linux_fork_detach and detach_one_lwp) to have
the same behavior and not free the lwp but do that in a separate
step ...

> Actually, that call looks unnecessary for the fork case too,
> since we have:
> 
>   linux_fork_detach
>     -> fork_load_infrun_state
>       -> linux_nat_switch_fork
>          -> purge_lwp_list
>             -> lwp_lwpid_htab_remove_pid
>                -> lwp_free  

...  I obviously missed that.

> 
> So... couldn't we just remove that delete_lwp line and be done with
> it?

Looks like we can get simply rid of it.  I'll see that I get a test
case running which forks to verify it, tomorrow.

Thanks
Philipp

> Thanks,
> Pedro Alves
>