Re: [PATCH] Fix crash of gdbserver when kill threads

[Hui Zhu <hui_zhu@mentor.com>]

Hi Pedro,

This issue is introduced by the patches for PR 12702 that was pushed by you.
Maybe you could take a look on this patch.

Thanks,
Hui

On 06/23/14 18:09, Hui Zhu wrote:
> gdbserver :1234 gdb.base/watch_thread_num
> gdb gdb.base/watch_thread_num
> (gdb) b 48
> Breakpoint 1 at 0x400737: file ../../../binutils-gdb/gdb/testsuite/gdb.base/watch_thread_num.c, line 48.
> (gdb) c
> Continuing.
>
> Breakpoint 1, main () at ../../../binutils-gdb/gdb/testsuite/gdb.base/watch_thread_num.c:48
> 48	    thread_result = thread_function ((void *) i);
> (gdb) k
> Kill the program being debugged? (y or n) y
> gdbserver :1234 gdb.base/watch_thread_num
> Process gdb.base/watch_thread_num created; pid = 9719
> Listening on port 1234
> Remote debugging from host 127.0.0.1
> Killing all inferiors
> Segmentation fault (core dumped)
>
> Backtrace:
> (gdb) bt
> #0  find_inferior (list=<optimized out>, func=func@entry=0x423990 <kill_one_lwp_callback>, arg=arg@entry=0x7fffe97405dc)
>      at ../../../binutils-gdb/gdb/gdbserver/inferiors.c:199
> #1  0x0000000000425bff in linux_kill (pid=10130) at ../../../binutils-gdb/gdb/gdbserver/linux-low.c:966
> #2  0x000000000040ae8c in kill_inferior_callback (entry=<optimized out>) at ../../../binutils-gdb/gdb/gdbserver/server.c:2934
> #3  0x0000000000405c61 in for_each_inferior (list=<optimized out>, action=action@entry=0x40ae60 <kill_inferior_callback>)
>      at ../../../binutils-gdb/gdb/gdbserver/inferiors.c:57
> #4  0x000000000040d5e2 in process_serial_event () at ../../../binutils-gdb/gdb/gdbserver/server.c:3767
> #5  handle_serial_event (err=<optimized out>, client_data=<optimized out>) at ../../../binutils-gdb/gdb/gdbserver/server.c:3880
> #6  0x0000000000412cda in handle_file_event (event_file_desc=event_file_desc@entry=4)
>      at ../../../binutils-gdb/gdb/gdbserver/event-loop.c:434
> #7  0x000000000041357a in process_event () at ../../../binutils-gdb/gdb/gdbserver/event-loop.c:189
> #8  start_event_loop () at ../../../binutils-gdb/gdb/gdbserver/event-loop.c:552
> #9  0x0000000000403088 in main (argc=3, argv=0x7fffe9740938) at ../../../binutils-gdb/gdb/gdbserver/server.c:3283
>
> The cause of this issue is when linux_kill call "find_inferior (&all_threads, kill_one_lwp_callback , &pid)"
> to kill all the lwp of pid.
> In linux_wait_for_event, it will delete_lwp any lwp in all_threads if it
> get exit event of it.  Then it make find_inferior crash.
>
> I make a patch that let kill_one_lwp_callback return 1, then after
> linux_wait_for_event is called(Maybe all_threads is changed), find_inferior
> will return.
> And change call "find_inferior (&all_threads, kill_one_lwp_callback , &pid)"
> to be a loop.  It will stop when all_threads doesn't have any lwp is pid.
>
> It pass regression test in x86_64 Linux.
>
> Thanks,
> Hui
>
> 2014-06-23  Hui Zhu  <hui@codesourcery.com>
>
> 	* linux-low.c (kill_one_lwp_callback): Change last return to 1.
> 	(linux_kill): Call find_inferior with a loop.
>
> --- a/gdb/gdbserver/linux-low.c
> +++ b/gdb/gdbserver/linux-low.c
> @@ -944,7 +944,9 @@ kill_one_lwp_callback (struct inferior_l
>         pid = linux_wait_for_event (thread->entry.id, &wstat, __WALL);
>       } while (pid > 0 && WIFSTOPPED (wstat));
>
> -  return 0;
> +  /* Let find_inferior return because maybe other lwp in the list will
> +     be deleted by delete_lwp.  */
> +  return 1;
>   }
>
>   static int
> @@ -963,7 +965,9 @@ linux_kill (int pid)
>        first, as PTRACE_KILL will not work otherwise.  */
>     stop_all_lwps (0, NULL);
>
> -  find_inferior (&all_threads, kill_one_lwp_callback , &pid);
> +  /* Keep call kill_one_lwp_callback until find_inferior cannot find any
> +     lwps that is for pid.  */
> +  while (find_inferior (&all_threads, kill_one_lwp_callback , &pid) != NULL);
>
>     /* See the comment in linux_kill_one_lwp.  We did not kill the first
>        thread in the list, so do so now.  */
>