This is the mail archive of the
gdb-patches@sourceware.org
mailing list for the GDB project.
Re: [PATCH v2] Fix read after xfree in linux_nat_detach
- From: Pedro Alves <palves at redhat dot com>
- To: Philipp Rudo <prudo at linux dot vnet dot ibm dot com>
- Cc: gdb-patches at sourceware dot org
- Date: Tue, 11 Apr 2017 14:31:10 +0100
- Subject: Re: [PATCH v2] Fix read after xfree in linux_nat_detach
- Authentication-results: sourceware.org; auth=none
- Authentication-results: ext-mx04.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com
- Authentication-results: ext-mx04.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=palves at redhat dot com
- Dkim-filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 6DE7280475
- Dmarc-filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 6DE7280475
- References: <20170322131132.98976-1-prudo@linux.vnet.ibm.com> <20170322131132.98976-2-prudo@linux.vnet.ibm.com> <1ba8e9a2-2155-cab4-a530-ef7344a40c33@redhat.com> <20170322181652.6d145e7f@ThinkPad> <4fd5805f-7763-9548-d743-45dd2aa1b17c@redhat.com> <20170323141724.1707affa@ThinkPad> <02be13b3-1711-545a-921c-80c4fd2da2e0@redhat.com>
Hi,
I ran gdb under Valgrind and noticed that this patch hadn't
been pushed yet. I've pushed it now.
FYI, for some reason the patch was corrupt and I had to
recreate it by hand:
$ git am prudo
Applying: Fix read after xfree in linux_nat_detach
fatal: corrupt patch at line 26
Patch failed at 0001 Fix read after xfree in linux_nat_detach
Thanks,
Pedro Alves
On 03/23/2017 01:42 PM, Pedro Alves wrote:
> OK.
>
> On 03/23/2017 01:17 PM, Philipp Rudo wrote:
>> On Wed, 22 Mar 2017 17:26:27 +0000
>> Pedro Alves <palves@redhat.com> wrote:
>>
>>> On 03/22/2017 05:16 PM, Philipp Rudo wrote:
>>>
>>>> Looks like we can get simply rid of it. I'll see that I get a test
>>>> case running which forks to verify it, tomorrow.
>>>
>>> This forks handling is the support for the "checkpoint" &
>>> friends commands, covered by gdb.base/checkpoint.exp.
>>> Doesn't seem to exercise detach yet though, unfortunately.
>>
>> I double checked, the same bug also happens when checkpointing. The
>> fix now is simply to remove delete_lwp at the end of linux_nat_detach.
>>
>> Although testing detach would be good, I'm not sure if the testsuite
>> would have found this bug.
>>
>> ---
>>
>> From ee3dced0b22cc1edb10a82aeb79ae35d78d665bc Mon Sep 17 00:00:00 2001
>> From: Philipp Rudo <prudo@linux.vnet.ibm.com>
>> Date: Wed, 22 Mar 2017 13:53:50 +0100
>> Subject: [PATCH v2] Fix read after xfree in linux_nat_detach
>>
>> At the end of linux_nat_detach the main_lwp is deleted (delete_lwp).
>> This is problematic as during detach (detach_one_lwp and
>> linux_fork_detach) main_lwp already gets freed. Thus calling
>> delete_lwp causes a read after free. Fix it by removing the
>> unnecessary delete_lwp.
>>
>> gdb/ChangeLog:
>> * linux-nat.c (linux_nat_detach): delete_lwp causes read after
>> free. Remove it.
>> ---
>> gdb/linux-nat.c | 1 -
>> 1 file changed, 1 deletion(-)
>>
>> diff --git a/gdb/linux-nat.c b/gdb/linux-nat.c
>> index dff0da5..efe7daf 100644
>> --- a/gdb/linux-nat.c
>> +++ b/gdb/linux-nat.c
>> @@ -1549,7 +1549,6 @@ linux_nat_detach (struct target_ops *ops, const
>> char *args, int from_tty)
>> inf_ptrace_detach_success (ops);
>> }
>> - delete_lwp (main_lwp->ptid);
>> }
>>
>> /* Resume execution of the inferior process. If STEP is nonzero,
>>
>
>