[Bug remote/26614] AddressSanitizer: heap-use-after-free of extended_remote_target in remote_async_inferior_event_handler

["vries at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26614

--- Comment #11 from Tom de Vries <vries at gcc dot gnu.org> ---
As experiment, I tried:
...
diff --git a/gdb/remote.c b/gdb/remote.c
index 59075cb09f..4dd165255e 100644
--- a/gdb/remote.c
+++ b/gdb/remote.c
@@ -4084,6 +4084,7 @@ remote_target::~remote_target ()
     return;

   serial_close (rs->remote_desc);
+  rs->remote_desc = nullptr;

   /* We are destroying the remote target, so we should discard
      everything of this target.  */
@@ -4093,6 +4094,7 @@ remote_target::~remote_target ()
     delete_async_event_handler (&rs->remote_async_inferior_event_token);

   delete rs->notif_state;
+  rs->notif_state = nullptr;
 }

 /* Query the remote side for the text, data and bss offsets.  */
...

And got (again at run 28):
...
(gdb) PASS: gdb.multi/multi-target-continue.exp: continue: non-stop=on:
inferior 2
Remote debugging from host ::1, port 42904
Process
/home/vries/gdb_versions/devel/build/gdb/testsuite/outputs/gdb.multi/multi-target-continue/multi-target-continue
created; pid = 27519
monitor exit
(gdb) Killing process(es): 27519

FAIL: gdb.multi/multi-target-continue.exp: continue: non-stop=on: inferior 5
(timeout)
Remote debugging from host ::1, port 43110
Process
/home/vries/gdb_versions/devel/build/gdb/testsuite/outputs/gdb.multi/multi-target-continue/multi-target-continue
created; pid = 27531
Thread 1 "gdb" received signal SIGSEGV, Segmentation fault.
0x00000000008e5a69 in std::equal_to<gdbarch*>::operator() (this=0x1f59be0,
__x=@0x7fffffffd100: 0x2264740, __y=<error reading variable>) at
/usr/include/c++/7/bits/stl_function.h:356
356           { return __x == __y; }
+backtrace
#0  0x00000000008e5a69 in std::equal_to<gdbarch*>::operator() (this=0x1f59be0,
__x=@0x7fffffffd100: 0x2264740, __y=<error reading variable>) at
/usr/include/c++/7/bits/stl_function.h:356
#1  0x00000000008e5085 in std::__detail::_Equal_helper<gdbarch*,
std::pair<gdbarch* const, remote_arch_state>, std::__detail::_Select1st,
std::equal_to<gdbarch*>, unsigned long, false>::_S_equals (__eq=...,
__extract=..., __k=@0x7fffffffd100: 0x2264740, __n=0x60) at
/usr/include/c++/7/bits/hashtable_policy.h:1444
#2  0x00000000008e4424 in std::__detail::_Hashtable_base<gdbarch*,
std::pair<gdbarch* const, remote_arch_state>, std::__detail::_Select1st,
std::equal_to<gdbarch*>, std::hash<gdbarch*>,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Hashtable_traits<false, false, true> >::_M_equals
(this=0x1f59be0, __k=@0x7fffffffd100: 0x2264740, __c=36063040, __n=0x60) at
/usr/include/c++/7/bits/hashtable_policy.h:1815
#3  0x00000000008e3077 in std::_Hashtable<gdbarch*, std::pair<gdbarch* const,
remote_arch_state>, std::allocator<std::pair<gdbarch* const, remote_arch_state>
>, std::__detail::_Select1st, std::equal_to<gdbarch*>, std::hash<gdbarch*>,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false,
false, true> >::_M_find_before_node (this=0x1f59be0, __n=0,
__k=@0x7fffffffd100: 0x2264740, __code=36063040) at
/usr/include/c++/7/bits/hashtable.h:1551
#4  0x00000000008e167a in std::_Hashtable<gdbarch*, std::pair<gdbarch* const,
remote_arch_state>, std::allocator<std::pair<gdbarch* const, remote_arch_state>
>, std::__detail::_Select1st, std::equal_to<gdbarch*>, std::hash<gdbarch*>,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false,
false, true> >::_M_find_node (this=0x1f59be0, __bkt=0, __key=@0x7fffffffd100:
0x2264740, __c=36063040) at /usr/include/c++/7/bits/hashtable.h:642
#5  0x00000000008df5ac in std::_Hashtable<gdbarch*, std::pair<gdbarch* const,
remote_arch_state>, std::allocator<std::pair<gdbarch* const, remote_arch_state>
>, std::__detail::_Select1st, std::equal_to<gdbarch*>, std::hash<gdbarch*>,
std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash,
std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false,
false, true> >::find (this=0x1f59be0, __k=@0x7fffffffd100: 0x2264740) at
/usr/include/c++/7/bits/hashtable.h:1425
#6  0x00000000008ddc6b in std::unordered_map<gdbarch*, remote_arch_state,
std::hash<gdbarch*>, std::equal_to<gdbarch*>, std::allocator<std::pair<gdbarch*
const, remote_arch_state> > >::find (this=0x1f59be0, __x=@0x7fffffffd100:
0x2264740) at /usr/include/c++/7/bits/unordered_map.h:920
#7  0x00000000008be731 in remote_state::get_remote_arch_state (this=0x1f599a8,
gdbarch=0x2264740) at /home/vries/gdb_versions/devel/src/gdb/remote.c:1203
#8  0x00000000008be84f in remote_target::get_remote_state (this=0x1f59990) at
/home/vries/gdb_versions/devel/src/gdb/remote.c:1232
#9  0x00000000008da485 in remote_async_inferior_event_handler (data=0x1f59990)
at /home/vries/gdb_versions/devel/src/gdb/remote.c:14171
#10 0x00000000004aa95e in check_async_event_handlers () at
/home/vries/gdb_versions/devel/src/gdb/async-event.c:295
#11 0x0000000000d0eaef in gdb_do_one_event () at
/home/vries/gdb_versions/devel/src/gdbsupport/event-loop.cc:194
#12 0x0000000000795ec7 in start_event_loop () at
/home/vries/gdb_versions/devel/src/gdb/main.c:356
#13 0x0000000000795fe7 in captured_command_loop () at
/home/vries/gdb_versions/devel/src/gdb/main.c:416
#14 0x0000000000797662 in captured_main (data=0x7fffffffd310) at
/home/vries/gdb_versions/devel/src/gdb/main.c:1253
#15 0x00000000007976c8 in gdb_main (args=0x7fffffffd310) at
/home/vries/gdb_versions/devel/src/gdb/main.c:1268
#16 0x0000000000415a9e in main (argc=5, argv=0x7fffffffd418) at
/home/vries/gdb_versions/devel/src/gdb/gdb.c:32
+quit
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.