On 7/6/20 10:28 PM, Simon Marchi wrote: > On 2020-07-06 3:02 p.m., Pedro Alves wrote: >> This patch series fixes PR 26199, a GDB 10 blocker. >> >> I discussed how to fix this with Simon, and we came to the conclusion >> that we can fix it by removing code. Easy. :-) That's the last patch >> in the series. >> >> Well, not so easy, actually... :-/ >> >> Doing that alone caused gdb.multi/multi-target.exp to regress. And >> the reason was that the fix for PR 261299 made that testcase trip on a >> few latent bugs... One of those bugs also caused a similar 100% cpu >> busy loop. >> >> And then, while fixing those, I added a new test scenario to >> gdb.multi/multi-target.exp to exercise the TARGET_WAITKIND_NO_RESUMED >> handling fixes in this series. That new test requires sending Ctrl-C >> to GDB after the test is done with, in order to cleanly kill gdbserver >> via "monitor exit". But, that Ctrl-C didn't work, due to an issue >> with GDB's terminal handling, GDB would just hang... >> >> That's all fixed by this series. >> >> Pedro Alves (6): >> Fix spurious unhandled remote %Stop notifications >> Fix latent bug in target_pass_ctrlc >> Avoid constant stream of TARGET_WAITKIND_NO_RESUMED >> Fix handle_no_resumed w/ multiple targets >> Make handle_no_resumed transfer terminal >> Testcase for previous handle_no_resumed fixes >> >> Simon Marchi (1): >> Fix GDB busy loop when interrupting non-stop program (PR 26199) >> >> gdb/infrun.c | 116 +++++++++++++++++++++---------- >> gdb/remote.c | 15 +++- >> gdb/target.c | 2 +- >> gdb/testsuite/gdb.multi/multi-target.c | 4 +- >> gdb/testsuite/gdb.multi/multi-target.exp | 76 ++++++++++++++++++++ >> 5 files changed, 173 insertions(+), 40 deletions(-) >> >> >> base-commit: ad8464f799a4c96c7ab8bdfec3f95846cf54f9b0 >> -- >> 2.14.5 >> > I am not sure why I didn't see this earlier, but gdb.multi/multi-target.exp > fails for me with my ASan-enabled build, using current master. There is > a use after free. Do you see the same? I've attached the ASan log. I can reproduce it. This is triggering right after GDB sends "monitor exit" to tear down gdbserver. If GDBserver is fast enough to exit and close its end of the socket, then gdb may end up trying to send a packet to gdbserver, which makes gdb realize the socket is closed, close the remote target, and throw an exception. I'm attaching a patch one can use to reproduce this more easily. Once gdb_interact kicks, you can attach to gdb from another terminal, and then issue "monitor exit" from the inferior gdb. > > ==18555==ERROR: AddressSanitizer: heap-use-after-free on address 0x621004670aa8 at pc 0x0000007ab125 bp 0x7ffdecaecd20 sp 0x7ffdecaecd10 > READ of size 4 at 0x621004670aa8 thread T0 > #0 0x7ab124 in dwarf2_frame_this_id /home/smarchi/src/binutils-gdb/gdb/dwarf2/frame.c:1228 > #1 0x983ec5 in compute_frame_id /home/smarchi/src/binutils-gdb/gdb/frame.c:550 > #2 0x9841ee in get_frame_id(frame_info*) /home/smarchi/src/binutils-gdb/gdb/frame.c:582 > #3 0x1093faa in scoped_restore_current_thread::scoped_restore_current_thread() /home/smarchi/src/binutils-gdb/gdb/thread.c:1462 > #4 0xaee5ba in fetch_inferior_event(void*) /home/smarchi/src/binutils-gdb/gdb/infrun.c:3968 > #5 0xaa990b in inferior_event_handler(inferior_event_type, void*) /home/smarchi/src/binutils-gdb/gdb/inf-loop.c:43 > #6 0xea61b6 in remote_async_serial_handler /home/smarchi/src/binutils-gdb/gdb/remote.c:14161 > #7 0xefca8a in run_async_handler_and_reschedule /home/smarchi/src/binutils-gdb/gdb/ser-base.c:137 > #8 0xefcd23 in fd_event /home/smarchi/src/binutils-gdb/gdb/ser-base.c:188 > #9 0x15a7416 in handle_file_event /home/smarchi/src/binutils-gdb/gdbsupport/event-loop.cc:548 > #10 0x15a7c36 in gdb_wait_for_event /home/smarchi/src/binutils-gdb/gdbsupport/event-loop.cc:673 > #11 0x15a5dbb in gdb_do_one_event() /home/smarchi/src/binutils-gdb/gdbsupport/event-loop.cc:215 > #12 0xbfe62d in start_event_loop /home/smarchi/src/binutils-gdb/gdb/main.c:356 > #13 0xbfe935 in captured_command_loop /home/smarchi/src/binutils-gdb/gdb/main.c:416 > #14 0xc01d39 in captured_main /home/smarchi/src/binutils-gdb/gdb/main.c:1253 > #15 0xc01dc9 in gdb_main(captured_main_args*) /home/smarchi/src/binutils-gdb/gdb/main.c:1268 > #16 0x414ddd in main /home/smarchi/src/binutils-gdb/gdb/gdb.c:32 > #17 0x7f590110b82f in __libc_start_main ../csu/libc-start.c:291 > #18 0x414bd8 in _start (/home/smarchi/build/binutils-gdb/gdb/gdb+0x414bd8) So what happens is that above, we're in dwarf2_frame_this_id, just after the dwarf2_frame_cache call. So you would think that the "cache" variable would be good. But it's not, that's what has been freed. But why has it been freed? See below. > > 0x621004670aa8 is located 424 bytes inside of 4064-byte region [0x621004670900,0x6210046718e0) > freed by thread T0 here: > #0 0x7f5903c42c7f in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10bc7f) > #1 0x98fb0c in xfree /home/smarchi/src/binutils-gdb/gdb/../gdbsupport/common-utils.h:62 > #2 0x160804b in call_freefun /home/smarchi/src/binutils-gdb/libiberty/obstack.c:103 > #3 0x1608a72 in _obstack_free /home/smarchi/src/binutils-gdb/libiberty/obstack.c:280 > #4 0x98af3b in reinit_frame_cache() /home/smarchi/src/binutils-gdb/gdb/frame.c:1864 > #5 0x109341c in switch_to_no_thread() /home/smarchi/src/binutils-gdb/gdb/thread.c:1301 > #6 0xad0cf2 in switch_to_inferior_no_thread(inferior*) /home/smarchi/src/binutils-gdb/gdb/inferior.c:612 > #7 0xe76c9f in remote_unpush_target /home/smarchi/src/binutils-gdb/gdb/remote.c:5521 > #8 0xe8d997 in remote_target::readchar(int) /home/smarchi/src/binutils-gdb/gdb/remote.c:9138 > #9 0xe90082 in remote_target::getpkt_or_notif_sane_1(std::vector > >*, int, int, int*) /home/smarchi/src/binutils-gdb/gdb/remote.c:9684 > #10 0xe90adc in remote_target::getpkt_sane(std::vector > >*, int) /home/smarchi/src/binutils-gdb/gdb/remote.c:9791 > #11 0xe8fe58 in remote_target::getpkt(std::vector > >*, int) /home/smarchi/src/binutils-gdb/gdb/remote.c:9624 > #12 0xe8c4b6 in remote_target::remote_read_bytes_1(unsigned long, unsigned char*, unsigned long, int, unsigned long*) /home/smarchi/src/binutils-gdb/gdb/remote.c:8861 > #13 0xe8cd1f in remote_target::remote_read_bytes(unsigned long, unsigned char*, unsigned long, int, unsigned long*) /home/smarchi/src/binutils-gdb/gdb/remote.c:8988 > #14 0xe96134 in remote_target::xfer_partial(target_object, char const*, unsigned char*, unsigned char const*, unsigned long, unsigned long, unsigned long*) /home/smarchi/src/binutils-gdb/gdb/remote.c:10988 > #15 0x104a76f in raw_memory_xfer_partial(target_ops*, unsigned char*, unsigned char const*, unsigned long, long, unsigned long*) /home/smarchi/src/binutils-gdb/gdb/target.c:918 > #16 0x104b65c in target_xfer_partial(target_ops*, target_object, char const*, unsigned char*, unsigned char const*, unsigned long, unsigned long, unsigned long*) /home/smarchi/src/binutils-gdb/gdb/target.c:1148 > #17 0x104c4b0 in target_read_partial /home/smarchi/src/binutils-gdb/gdb/target.c:1379 > #18 0x104c68e in target_read(target_ops*, target_object, char const*, unsigned char*, unsigned long, long) /home/smarchi/src/binutils-gdb/gdb/target.c:1419 > #19 0x104bd7a in target_read_raw_memory(unsigned long, unsigned char*, long) /home/smarchi/src/binutils-gdb/gdb/target.c:1252 > #20 0x761b32 in dcache_read_line /home/smarchi/src/binutils-gdb/gdb/dcache.c:336 > #21 0x761ebf in dcache_peek_byte /home/smarchi/src/binutils-gdb/gdb/dcache.c:403 > #22 0x76244d in dcache_read_memory_partial(target_ops*, dcache_struct*, unsigned long, unsigned char*, unsigned long, unsigned long*) /home/smarchi/src/binutils-gdb/gdb/dcache.c:484 > #23 0x104ae00 in memory_xfer_partial_1 /home/smarchi/src/binutils-gdb/gdb/target.c:1033 > #24 0x104b03d in memory_xfer_partial /home/smarchi/src/binutils-gdb/gdb/target.c:1076 > #25 0x104b5c7 in target_xfer_partial(target_ops*, target_object, char const*, unsigned char*, unsigned char const*, unsigned long, unsigned long, unsigned long*) /home/smarchi/src/binutils-gdb/gdb/target.c:1133 > #26 0x11e85c3 in read_value_memory(value*, long, int, unsigned long, unsigned char*, unsigned long) /home/smarchi/src/binutils-gdb/gdb/valops.c:956 > #27 0x121eb88 in value_fetch_lazy_memory /home/smarchi/src/binutils-gdb/gdb/value.c:3764 > #28 0x121fa89 in value_fetch_lazy(value*) /home/smarchi/src/binutils-gdb/gdb/value.c:3910 > #29 0x1214bcc in value_optimized_out(value*) /home/smarchi/src/binutils-gdb/gdb/value.c:1411 It is not immediately obvious because the backtrace is trimmed, but this backtrace that lead to the free is _within_ the dwarf2_frame_this_id -> dwarf2_frame_cache: (top-gdb) bt #0 reinit_frame_cache () at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/frame.c:1855 #1 0x00000000014ff7b0 in switch_to_no_thread () at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/thread.c:1301 #2 0x0000000000f66d3e in switch_to_inferior_no_thread (inf=0x615000338180) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/inferior.c:626 #3 0x00000000012f3826 in remote_unpush_target (target=0x6170000c5900) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:5521 #4 0x00000000013097e0 in remote_target::readchar (this=0x6170000c5900, timeout=2) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:9137 #5 0x000000000130be4d in remote_target::getpkt_or_notif_sane_1 (this=0x6170000c5900, buf=0x6170000c5918, forever=0, expecting_notif=0, is_notif=0x0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:9683 #6 0x000000000130c8ab in remote_target::getpkt_sane (this=0x6170000c5900, buf=0x6170000c5918, forever=0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:9790 #7 0x000000000130bc0d in remote_target::getpkt (this=0x6170000c5900, buf=0x6170000c5918, forever=0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:9623 #8 0x000000000130838e in remote_target::remote_read_bytes_1 (this=0x6170000c5900, memaddr=0x7fffffffcdc0, myaddr=0x6080000ad3bc "", len_units=64, unit_size=1, xfered_len_units=0x7fff6a29b9a0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:8860 #9 0x0000000001308bd2 in remote_target::remote_read_bytes (this=0x6170000c5900, memaddr=0x7fffffffcdc0, myaddr=0x6080000ad3bc "", len=64, unit_size=1, xfered_len=0x7fff6a29b9a0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:8987 #10 0x0000000001311ed1 in remote_target::xfer_partial (this=0x6170000c5900, object=TARGET_OBJECT_MEMORY, annex=0x0, readbuf=0x6080000ad3bc "", writebuf=0x0, offset=140737488342464, len=64, xfered_len=0x7fff6a29b9a0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:10988 #11 0x00000000014ba969 in raw_memory_xfer_partial (ops=0x6170000c5900, readbuf=0x6080000ad3bc "", writebuf=0x0, memaddr=140737488342464, len=64, xfered_len=0x7fff6a29b9a0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:918 #12 0x00000000014bb720 in target_xfer_partial (ops=0x6170000c5900, object=TARGET_OBJECT_RAW_MEMORY, annex=0x0, readbuf=0x6080000ad3bc "", writebuf=0x0, offset=140737488342464, len=64, xfered_len=0x7fff6a29b9a0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:1148 #13 0x00000000014bc3b5 in target_read_partial (ops=0x6170000c5900, object=TARGET_OBJECT_RAW_MEMORY, annex=0x0, buf=0x6080000ad3bc "", offset=140737488342464, len=64, xfered_len=0x7fff6a29b9a0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:1380 #14 0x00000000014bc593 in target_read (ops=0x6170000c5900, object=TARGET_OBJECT_RAW_MEMORY, annex=0x0, buf=0x6080000ad3bc "", offset=140737488342464, len=64) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:1419 #15 0x00000000014bbd4d in target_read_raw_memory (memaddr=0x7fffffffcdc0, myaddr=0x6080000ad3bc "", len=64) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:1252 #16 0x0000000000bf27df in dcache_read_line (dcache=0x6060001eddc0, db=0x6080000ad3a0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/dcache.c:336 #17 0x0000000000bf2b72 in dcache_peek_byte (dcache=0x6060001eddc0, addr=0x7fffffffcdd8, ptr=0x6020001231b0 "") at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/dcache.c:403 #18 0x0000000000bf3103 in dcache_read_memory_partial (ops=0x6170000c5900, dcache=0x6060001eddc0, memaddr=0x7fffffffcdd8, myaddr=0x6020001231b0 "", len=8, xfered_len=0x7fff6a29bf20) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/dcache.c:484 #19 0x00000000014bafe9 in memory_xfer_partial_1 (ops=0x6170000c5900, object=TARGET_OBJECT_STACK_MEMORY, readbuf=0x6020001231b0 "", writebuf=0x0, memaddr=140737488342488, len=8, xfered_len=0x7fff6a29bf20) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:1034 #20 0x00000000014bb212 in memory_xfer_partial (ops=0x6170000c5900, object=TARGET_OBJECT_STACK_MEMORY, readbuf=0x6020001231b0 "", writebuf=0x0, memaddr=140737488342488, len=8, xfered_len=0x7fff6a29bf20) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:1076 #21 0x00000000014bb6b3 in target_xfer_partial (ops=0x6170000c5900, object=TARGET_OBJECT_STACK_MEMORY, annex=0x0, readbuf=0x6020001231b0 "", writebuf=0x0, offset=140737488342488, len=8, xfered_len=0x7fff6a29bf20) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:1133 #22 0x000000000164564d in read_value_memory (val=0x60f000029440, bit_offset=0, stack=1, memaddr=0x7fffffffcdd8, buffer=0x6020001231b0 "", length=8) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/valops.c:956 #23 0x0000000001680fff in value_fetch_lazy_memory (val=0x60f000029440) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/value.c:3764 #24 0x0000000001681efd in value_fetch_lazy (val=0x60f000029440) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/value.c:3910 #25 0x0000000001676143 in value_optimized_out (value=0x60f000029440) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/value.c:1411 #26 0x0000000000e0fcb8 in frame_register_unwind (next_frame=0x6210066bfde0, regnum=16, optimizedp=0x7fff6a29c200, unavailablep=0x7fff6a29c240, lvalp=0x7fff6a29c2c0, addrp=0x7fff6a29c300, realnump=0x7fff6a29c280, bufferp=0x7fff6a29c3a0 "@\304)j\377\177") at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/frame.c:1144 #27 0x0000000000e10418 in frame_unwind_register (next_frame=0x6210066bfde0, regnum=16, buf=0x7fff6a29c3a0 "@\304)j\377\177") at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/frame.c:1196 #28 0x0000000000f00431 in i386_unwind_pc (gdbarch=0x6210043d0110, next_frame=0x6210066bfde0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/i386-tdep.c:1969 #29 0x0000000000e39724 in gdbarch_unwind_pc (gdbarch=0x6210043d0110, next_frame=0x6210066bfde0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/gdbarch.c:3056 #30 0x0000000000c2ea90 in dwarf2_tailcall_sniffer_first (this_frame=0x6210066bfde0, tailcall_cachep=0x6210066bfee0, entry_cfa_sp_offsetp=0x0) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/dwarf2/frame-tailcall.c:423 #31 0x0000000000c36bdb in dwarf2_frame_cache (this_frame=0x6210066bfde0, this_cache=0x6210066bfdf8) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/dwarf2/frame.c:1198 #32 0x0000000000c36eb3 in dwarf2_frame_this_id (this_frame=0x6210066bfde0, this_cache=0x6210066bfdf8, this_id=0x6210066bfe40) at /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/dwarf2/frame.c:1226 Note that remote_target::readchar in frame #3 throws TARGET_CLOSE_ERROR after that remote_unpush_target in frame #3 returns. The problem is that that TARGET_CLOSE_ERROR is swallowed by value_optimized_out in frame #25. If we fix that one, then we run into dwarf2_tailcall_sniffer_first swallowing the exception in frame #30 too. The attached patch fixes that issue for me, but I've not run the whole testsuite with it yet. I'm not 100% sure that that makes us catch all the important exceptions. I've thought before about making TARGET_CLOSE_ERROR be more like a QUIT exception, which is not caught by catch gdb_exception_error, but I've resisted exactly because it tends to be wrong to swallow too much, I think. However, with the fix, the testcase now runs into another Asan-reported issue: ================================================================= ==9211==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000b1080 at pc 0x000000dd0344 bp 0x7ffe4bebca90 sp 0x7ffe4bebca80 READ of size 4 at 0x6160000b1080 thread T0 #0 0xdd0343 in refcounted_object::incref() /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/../gdbsupport/refcounted-object.h:34 #1 0x150066f in scoped_restore_current_thread::scoped_restore_current_thread() /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/thread.c:1471 #2 0xf83564 in fetch_inferior_event() /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/infrun.c:3952 #3 0xf40736 in inferior_event_handler(inferior_event_type) /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/inf-loop.c:42 #4 0x1321e75 in remote_async_serial_handler /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:14160 #5 0x1371849 in run_async_handler_and_reschedule /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/ser-base.c:137 #6 0x1371ae2 in fd_event /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/ser-base.c:188 #7 0x19fc1f7 in handle_file_event /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdbsupport/event-loop.cc:548 #8 0x19fca14 in gdb_wait_for_event /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdbsupport/event-loop.cc:673 #9 0x19fab94 in gdb_do_one_event() /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdbsupport/event-loop.cc:215 #10 0x1087704 in start_event_loop /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/main.c:356 #11 0x10879f5 in captured_command_loop /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/main.c:416 #12 0x108aef1 in captured_main /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/main.c:1253 #13 0x108af81 in gdb_main(captured_main_args*) /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/main.c:1268 #14 0x8af9fa in main /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/gdb.c:32 #15 0x7f07d5efbfe9 in __libc_start_main (/lib64/libc.so.6+0x20fe9) #16 0x8af809 in _start (/home/pedro/brno/pedro/gdb/binutils-gdb-2/build-asan/gdb/gdb+0x8af809) 0x6160000b1080 is located 0 bytes inside of 592-byte region [0x6160000b1080,0x6160000b12d0) freed by thread T0 here: #0 0x7f07d97966d8 in operator delete(void*, unsigned long) (/lib64/libasan.so.4+0xe16d8) #1 0x14f7147 in delete_thread_1 /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/thread.c:452 #2 0x14f7171 in delete_thread(thread_info*) /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/thread.c:460 #3 0xf6278d in exit_inferior_1 /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/inferior.c:204 #4 0xf62b5b in exit_inferior(inferior*) /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/inferior.c:236 #5 0x14c32a6 in generic_mourn_inferior() /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/target.c:3119 #6 0x12f388a in remote_unpush_target /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:5523 #7 0x1309835 in remote_target::readchar(int) /home/pedro/brno/pedro/gdb/binutils-gdb-2/build/../src/gdb/remote.c:9137 Odd, kind of looks like we're mishandling the thread_info refcounts.