[Bug remote/26614] AddressSanitizer: heap-use-after-free of extended_remote_target in remote_async_inferior_event_handler

["simark at simark dot ca" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26614

--- Comment #21 from Simon Marchi <simark at simark dot ca> ---
(In reply to Pedro Alves from comment #20)
> target_ops is reference counted.  Wouldn't this patch fix the issue?
> 
> diff --git c/gdb/remote.c w/gdb/remote.c
> index 71f814efb36..5a5ac1ee92f 100644
> --- c/gdb/remote.c
> +++ w/gdb/remote.c
> @@ -14174,9 +14174,13 @@ remote_async_serial_handler (struct serial *scb,
> void *context)
>  static void
>  remote_async_inferior_event_handler (gdb_client_data data)
>  {
> +  remote_target *remote = (remote_target *) data;
> +  /* Hold a strong reference to the remote target while handling an
> +     event, since that could result in closing the connection.  */
> +  auto remote_ref = target_ops_ref::new_reference (remote);
> +
>    inferior_event_handler (INF_REG_EVENT);
>  
> -  remote_target *remote = (remote_target *) data;
>    remote_state *rs = remote->get_remote_state ();
>  
>    /* inferior_event_handler may have consumed an event pending on the

Hmm, right.  I have my patch series almost ready to send, and I think it's a
desirable change in any case, so I'll still send it for review.

-- 
You are receiving this mail because:
You are on the CC list for the bug.