This is the mail archive of the
gdb-patches@sourceware.org
mailing list for the GDB project.
[PATCH 2/2] Delete thread_info is refcount is zero
- From: Yao Qi <qiyaoltc at gmail dot com>
- To: gdb-patches at sourceware dot org
- Date: Tue, 28 Mar 2017 09:24:43 +0100
- Subject: [PATCH 2/2] Delete thread_info is refcount is zero
- Authentication-results: sourceware.org; auth=none
- References: <1490689483-16084-1-git-send-email-yao.qi@linaro.org>
I build GDB with asan, and run test case hook-stop.exp, and threadapply.exp,
I got the following asan error,
=================================================================^M
^[[1m^[[31m==2291==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000999c4 at pc 0x000000826022 bp 0x7ffd28a8ff70 sp 0x7ffd28a8ff60^M
^[[1m^[[0m^[[1m^[[34mREAD of size 4 at 0x6160000999c4 thread T0^[[1m^[[0m^M
#0 0x826021 in release_stop_context_cleanup ../../binutils-gdb/gdb/infrun.c:8203^M
#1 0x72798a in do_my_cleanups ../../binutils-gdb/gdb/common/cleanups.c:154^M
#2 0x727a32 in do_cleanups(cleanup*) ../../binutils-gdb/gdb/common/cleanups.c:176^M
#3 0x826895 in normal_stop() ../../binutils-gdb/gdb/infrun.c:8381^M
#4 0x815208 in fetch_inferior_event(void*) ../../binutils-gdb/gdb/infrun.c:4011^M
#5 0x868aca in inferior_event_handler(inferior_event_type, void*) ../../binutils-gdb/gdb/inf-loop.c:44^M
....
^[[1m^[[32m0x6160000999c4 is located 68 bytes inside of 568-byte region [0x616000099980,0x616000099bb8)^M
^[[1m^[[0m^[[1m^[[35mfreed by thread T0 here:^[[1m^[[0m^M
#0 0x7fb0bc1312ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)^M
#1 0xb8c62f in xfree(void*) ../../binutils-gdb/gdb/common/common-utils.c:100^M
#2 0x83df67 in free_thread ../../binutils-gdb/gdb/thread.c:207^M
#3 0x83dfd2 in init_thread_list() ../../binutils-gdb/gdb/thread.c:223^M
#4 0x805494 in kill_command ../../binutils-gdb/gdb/infcmd.c:2595^M
....
Detaching from program: /home/yao.qi/SourceCode/gnu/build-with-asan/gdb/testsuite/outputs/gdb.threads/threadapply/threadapply, process 2399^M
=================================================================^M
^[[1m^[[31m==2387==ERROR: AddressSanitizer: heap-use-after-free on address 0x6160000a98c0 at pc 0x00000083fd28 bp 0x7ffd401c3110 sp 0x7ffd401c3100^M
^[[1m^[[0m^[[1m^[[34mREAD of size 4 at 0x6160000a98c0 thread T0^[[1m^[[0m^M
#0 0x83fd27 in thread_alive ../../binutils-gdb/gdb/thread.c:741^M
#1 0x844277 in thread_apply_all_command ../../binutils-gdb/gdb/thread.c:1804^M
....
^M
^[[1m^[[32m0x6160000a98c0 is located 64 bytes inside of 568-byte region [0x6160000a9880,0x6160000a9ab8)^M
^[[1m^[[0m^[[1m^[[35mfreed by thread T0 here:^[[1m^[[0m^M
#0 0x7f59a7e322ca in __interceptor_free (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x982ca)^M
#1 0xb8c62f in xfree(void*) ../../binutils-gdb/gdb/common/common-utils.c:100^M
#2 0x83df67 in free_thread ../../binutils-gdb/gdb/thread.c:207^M
#3 0x83dfd2 in init_thread_list() ../../binutils-gdb/gdb/thread.c:223^M
This patch fixes the issue by always checking refcount before decreasing it.
If it is zero already, delete the thread_info.
gdb:
2017-03-28 Yao Qi <yao.qi@linaro.org>
PR gdb/19942
* infrun.c (release_stop_context_cleanup): If refcount is zero
delete thread, otherwise decrease the refcount.
* thread.c (init_thread_list): Likewise.
(restore_current_thread_cleanup_dtor): Likewise.
(set_thread_refcount): Likewise.
---
gdb/infrun.c | 7 ++++++-
gdb/thread.c | 19 ++++++++++++++++---
2 files changed, 22 insertions(+), 4 deletions(-)
diff --git a/gdb/infrun.c b/gdb/infrun.c
index c8c2d6e..f8eeddb 100644
--- a/gdb/infrun.c
+++ b/gdb/infrun.c
@@ -8182,7 +8182,12 @@ release_stop_context_cleanup (void *arg)
struct stop_context *sc = (struct stop_context *) arg;
if (sc->thread != NULL)
- sc->thread->refcount--;
+ {
+ if (sc->thread->refcount == 0)
+ delete sc->thread;
+ else
+ sc->thread->refcount--;
+ }
xfree (sc);
}
diff --git a/gdb/thread.c b/gdb/thread.c
index 28907c5..b38c5bd 100644
--- a/gdb/thread.c
+++ b/gdb/thread.c
@@ -205,8 +205,11 @@ init_thread_list (void)
for (tp = thread_list; tp; tp = tpnext)
{
tpnext = tp->next;
- delete tp;
+ if (tp->refcount == 0)
+ delete tp;
+ else
+ tp->refcount--;
}
thread_list = NULL;
@@ -1636,7 +1639,12 @@ restore_current_thread_cleanup_dtor (void *arg)
tp = find_thread_ptid (old->inferior_ptid);
if (tp)
- tp->refcount--;
+ {
+ if (tp->refcount == 0)
+ delete tp;
+ else
+ tp->refcount--;
+ }
inf = find_inferior_id (old->inf_id);
if (inf != NULL)
inf->removable = old->was_removable;
@@ -1653,7 +1661,12 @@ set_thread_refcount (void *data)
= (struct thread_array_cleanup *) data;
for (k = 0; k != ta_cleanup->count; k++)
- ta_cleanup->tp_array[k]->refcount--;
+ {
+ if (ta_cleanup->tp_array[k]->refcount == 0)
+ delete ta_cleanup->tp_array[k];
+ else
+ ta_cleanup->tp_array[k]->refcount--;
+ }
}
struct cleanup *
--
1.9.1