[PATCH] Fix crash of gdbserver when kill threads

Hui Zhu
2014-06-23T10:10:34Z

gdbserver :1234 gdb.base/watch_thread_num
gdb gdb.base/watch_thread_num
(gdb) b 48
Breakpoint 1 at 0x400737: file ../../../binutils-gdb/gdb/testsuite/gdb.base/watch_thread_num.c, line 48.
(gdb) c
Continuing.

Breakpoint 1, main () at ../../../binutils-gdb/gdb/testsuite/gdb.base/watch_thread_num.c:48
48 thread_result = thread_function ((void *) i);
(gdb) k
Kill the program being debugged? (y or n) y
gdbserver :1234 gdb.base/watch_thread_num
Process gdb.base/watch_thread_num created; pid = 9719
Listening on port 1234
Remote debugging from host 127.0.0.1
Killing all inferiors
Segmentation fault (core dumped)

Backtrace:
(gdb) bt
#0 find_inferior (list=<optimized out>, func=func@entry=0x423990 <kill_one_lwp_callback>, arg=arg@entry=0x7fffe97405dc)
at ../../../binutils-gdb/gdb/gdbserver/inferiors.c:199
#1 0x0000000000425bff in linux_kill (pid=10130) at ../../../binutils-gdb/gdb/gdbserver/linux-low.c:966
#2 0x000000000040ae8c in kill_inferior_callback (entry=<optimized out>) at ../../../binutils-gdb/gdb/gdbserver/server.c:2934
#3 0x0000000000405c61 in for_each_inferior (list=<optimized out>, action=action@entry=0x40ae60 <kill_inferior_callback>)
at ../../../binutils-gdb/gdb/gdbserver/inferiors.c:57
#4 0x000000000040d5e2 in process_serial_event () at ../../../binutils-gdb/gdb/gdbserver/server.c:3767
#5 handle_serial_event (err=<optimized out>, client_data=<optimized out>) at ../../../binutils-gdb/gdb/gdbserver/server.c:3880
#6 0x0000000000412cda in handle_file_event (event_file_desc=event_file_desc@entry=4)
at ../../../binutils-gdb/gdb/gdbserver/event-loop.c:434
#7 0x000000000041357a in process_event () at ../../../binutils-gdb/gdb/gdbserver/event-loop.c:189
#8 start_event_loop () at ../../../binutils-gdb/gdb/gdbserver/event-loop.c:552
#9 0x0000000000403088 in main (argc=3, argv=0x7fffe9740938) at ../../../binutils-gdb/gdb/gdbserver/server.c:3283

The cause of this issue is when linux_kill call "find_inferior (&all_threads, kill_one_lwp_callback , &pid)"
to kill all the lwp of pid.
In linux_wait_for_event, it will delete_lwp any lwp in all_threads if it
get exit event of it. Then it make find_inferior crash.

I make a patch that let kill_one_lwp_callback return 1, then after
linux_wait_for_event is called(Maybe all_threads is changed), find_inferior
will return.
And change call "find_inferior (&all_threads, kill_one_lwp_callback , &pid)"
to be a loop. It will stop when all_threads doesn't have any lwp is pid.

It pass regression test in x86_64 Linux.

Thanks,
Hui

2014-06-23 Hui Zhu <hui@codesourcery.com>

* linux-low.c (kill_one_lwp_callback): Change last return to 1.
(linux_kill): Call find_inferior with a loop.

--- a/gdb/gdbserver/linux-low.c
+++ b/gdb/gdbserver/linux-low.c
@@ -944,7 +944,9 @@ kill_one_lwp_callback (struct inferior_l
pid = linux_wait_for_event (thread->entry.id, &wstat, __WALL);
} while (pid > 0 && WIFSTOPPED (wstat));

- return 0;
+ /* Let find_inferior return because maybe other lwp in the list will
+ be deleted by delete_lwp. */
+ return 1;
}

static int
@@ -963,7 +965,9 @@ linux_kill (int pid)
first, as PTRACE_KILL will not work otherwise. */
stop_all_lwps (0, NULL);

- find_inferior (&all_threads, kill_one_lwp_callback , &pid);
+ /* Keep call kill_one_lwp_callback until find_inferior cannot find any
+ lwps that is for pid. */
+ while (find_inferior (&all_threads, kill_one_lwp_callback , &pid) != NULL);

/* See the comment in linux_kill_one_lwp. We did not kill the first
thread in the list, so do so now. */