[Bug gdb/27894] New: sigsegv in serial_event_set on ^C

[Bug gdb/27894] New: sigsegv in serial_event_set on ^C

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27894

            Bug ID: 27894
           Summary: sigsegv in serial_event_set on ^C
           Product: gdb
           Version: 10.1
            Status: NEW
          Severity: normal
          Priority: P2
         Component: gdb
          Assignee: unassigned at sourceware dot org
          Reporter: vries at gcc dot gnu.org
  Target Milestone: ---

[ This is with openSUSE Leap 15.2 system gdb. ] 

I wrote a loop to read installed package debug files, to see if I could trigger
a dwarf error anywhere:
...
$ for f in $(find /usr/lib/debug/ -type f -name *.debug); do echo $f; gdb -q
-batch -ex "symbol-file $f"; done
....

After starting the command I realized I needed to redirect output to a log, and
started doing ^C.

This ended up in gdb generating a core file.

Backtrace:
...
$ gdb -q /usr/bin/gdb core  
Reading symbols from /usr/bin/gdb...
Reading symbols from
/usr/lib/debug/usr/bin/gdb-10.1-lp152.7.6.1.x86_64.debug...
[New LWP 9648]
[New LWP 9650]
[New LWP 9652]
[New LWP 9653]
[New LWP 9651]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `gdb -q -batch -ex symbol-file
/usr/lib/debug/sbin/ldconfig-2.26-lp152.26.6.1.x8'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  serial_event_set (event=0x0) at ../../gdb/ser-event.c:184
184       struct serial_event_state *state = (struct serial_event_state *)
ser->state;
[Current thread is 1 (Thread 0x7fb1215baf40 (LWP 9648))]
(gdb) bt
#0  serial_event_set (event=0x0) at ../../gdb/ser-event.c:184
#1  0x0000564dbed01ef5 in restore_active_ext_lang (previous=0x564dc0ecf440)
    at ../../gdb/extension.c:730
#2  0x0000564dbee49170 in gdbpy_enter::~gdbpy_enter (this=0x7fffda0c22d0, 
    __in_chrg=<optimized out>) at ../../gdb/python/python.c:237
#3  0x0000564dbee2fbdd in python_new_inferior (inf=0x564dc0ece070)
    at ../../gdb/python/py-inferior.c:254
#4  0x0000564dbed56fb9 in std::function<void
(inferior*)>::operator()(inferior*) const (
    __args#0=<optimized out>, this=0x564dc0e28f90)
    at /usr/include/c++/7/bits/std_function.h:706
#5  gdb::observers::observable<inferior*>::notify (args#0=0x564dc0ece070, 
    this=<optimized out>) at ../../gdb/../gdbsupport/observable.h:106
#6  add_inferior_silent (pid=pid@entry=0) at ../../gdb/inferior.c:127
#7  0x0000564dbed57918 in initialize_inferiors () at ../../gdb/inferior.c:961
#8  0x0000564dbef3d3ab in gdb_init (argv0=<optimized out>) at
../../gdb/top.c:2358
#9  0x0000564dbeda85f0 in captured_main_1
(context=context@entry=0x7fffda0c2640)
    at ../../gdb/main.c:962
#10 0x0000564dbeda9606 in captured_main (data=data@entry=0x7fffda0c2640)
    at ../../gdb/main.c:1294
#11 0x0000564dbeda9656 in gdb_main (args=args@entry=0x7fffda0c2640) at
../../gdb/main.c:1319
#12 0x0000564dbeb85de4 in main (argc=5, argv=0x7fffda0c2758) at
../../gdb/gdb.c:40
...

AFAICT, the problem is:
...
(gdb) p quit_serial_event
$1 = (serial_event *) 0x0
(gdb) 
...
so when calling set_quit_flag from restore_active_ext_lang, we do
quit_serial_event_set so we call:
...
  serial_event_set (quit_serial_event);
...
with quit_serial_event == NULL.

I'd like to try to reproduce this on upstream gdb, but I suppose the timing of
the ^C got to be right.

So that'll be either modifying gdb to signal itself at the proper time, or
having gdb as a target process of gdb such that it can be stopped at the
appropriate location, after which the signal can be delivered, and the target
process continued.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug gdb/27894] sigsegv in serial_event_set on ^C

[vries at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27894

--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
I've played around a bit trying to reproduce this, but didn't manage.

I'm out of ideas, but I'm going to keep the gdb and core files around for a
bit.

-- 
You are receiving this mail because:
You are on the CC list for the bug.