From de146e1946ee45f2552c6b56714793a2eba9b823 Mon Sep 17 00:00:00 2001 From: Simon Marchi Date: Mon, 22 Feb 2021 11:41:32 -0500 Subject: [PATCH] gdb: push target earlier in procfs_target::attach (PR 27435) Since this is a GDB 9 -> 10 regression, I would like to push it to gdb-10-branch. This is a follow-up to: https://sourceware.org/pipermail/gdb-patches/2021-February/176202.html This patch fixes a segfault seen when attaching to a process on Solaris. The steps leading to the segfault are: - procfs_target::attach calls do_attach, at this point the inferior's process slot in the target stack is empty. - do_attach adds a thread with `add_thread (&the_procfs_target, ptid)` - in add_thread_silent, the passed target (&the_procfs_target) is passed to find_inferior_ptid - find_inferior_ptid returns nullptr, as there is no inferior with this ptid that has &the_procfs_target as its process target - the nullptr `inf` is passed to find_thread_ptid, which dereferences it, causing a segfault - back in procfs_target::attach, after do_attach, we push the the_procfs_target on the inferior's target stack, although we never reach this because the segfault happens before. To fix this, I think we need to do the same as is done in inf_ptrace_target::attach: push the target early and unpush it in case the attach fails (and keep it if the attach succeeds). Implement it by moving target_unpush_up to target.h, so it can be re-used here. Make procfs_target::attach use it. Note that just like is mentioned in inf_ptrace_target::attach, we should push the target before calling target_pid_to_str, so that calling target_pid_to_str ends up in procfs_target::pid_to_str. Tested by trying to attach on a process on gcc211 on the gcc compile farm. gdb/ChangeLog: PR gdb/27435 * inf-ptrace.c (struct target_unpusher): Move to target.h. (target_unpush_up): Likewise. * procfs.c (procfs_target::attach): Push target early. Use target_unpush_up to unpush target in case of error. * target.h (struct target_unpusher): Move here. (target_unpush_up): Likewise. Change-Id: I88aff8b20204e1ca1d792e27ac6bc34fc1aa0d52 --- gdb/ChangeLog | 10 ++++++++++ gdb/inf-ptrace.c | 16 ---------------- gdb/procfs.c | 14 ++++++++++++-- gdb/target.h | 14 ++++++++++++++ 4 files changed, 36 insertions(+), 18 deletions(-) diff --git a/gdb/ChangeLog b/gdb/ChangeLog index beee6135347..c2c86705e0c 100644 --- a/gdb/ChangeLog +++ b/gdb/ChangeLog @@ -1,3 +1,13 @@ +2021-02-22 Simon Marchi + + PR gdb/27435 + * inf-ptrace.c (struct target_unpusher): Move to target.h. + (target_unpush_up): Likewise. + * procfs.c (procfs_target::attach): Push target early. Use + target_unpush_up to unpush target in case of error. + * target.h (struct target_unpusher): Move here. + (target_unpush_up): Likewise. + 2021-02-19 Kevin Buettner * nat/amd64-linux-siginfo.c: Include "gdbsupport/common-defs.h" diff --git a/gdb/inf-ptrace.c b/gdb/inf-ptrace.c index 0f2f56cc366..7ca02dfd876 100644 --- a/gdb/inf-ptrace.c +++ b/gdb/inf-ptrace.c @@ -49,22 +49,6 @@ gdb_ptrace (PTRACE_TYPE_ARG1 request, ptid_t ptid, PTRACE_TYPE_ARG3 addr, #endif } -/* A unique_ptr helper to unpush a target. */ - -struct target_unpusher -{ - void operator() (struct target_ops *ops) const - { - unpush_target (ops); - } -}; - -/* A unique_ptr that unpushes a target on destruction. */ - -typedef std::unique_ptr target_unpush_up; - - - inf_ptrace_target::~inf_ptrace_target () {} diff --git a/gdb/procfs.c b/gdb/procfs.c index e73faa8d41d..cab29c3cbbc 100644 --- a/gdb/procfs.c +++ b/gdb/procfs.c @@ -1767,6 +1767,14 @@ procfs_target::attach (const char *args, int from_tty) if (pid == getpid ()) error (_("Attaching GDB to itself is not a good idea...")); + /* Push the target if needed, ensure it gets un-pushed it if attach fails. */ + target_unpush_up unpusher; + if (!target_is_pushed (this)) + { + push_target (this); + unpusher.reset (this); + } + if (from_tty) { const char *exec_file = get_exec_file (0); @@ -1780,9 +1788,11 @@ procfs_target::attach (const char *args, int from_tty) fflush (stdout); } + do_attach (ptid_t (pid)); - if (!target_is_pushed (this)) - push_target (this); + + /* Everything went fine, keep the target pushed. */ + unpusher.release (); } void diff --git a/gdb/target.h b/gdb/target.h index 0de78075e9b..52e23b05ffd 100644 --- a/gdb/target.h +++ b/gdb/target.h @@ -2392,6 +2392,20 @@ extern void push_target (target_ops_up &&); extern int unpush_target (struct target_ops *); +/* A unique_ptr helper to unpush a target. */ + +struct target_unpusher +{ + void operator() (struct target_ops *ops) const + { + unpush_target (ops); + } +}; + +/* A unique_ptr that unpushes a target on destruction. */ + +typedef std::unique_ptr target_unpush_up; + extern void target_pre_inferior (int); extern void target_preopen (int); -- 2.30.2