No description
Find a file
Andrew Burgess e0f0649602 gdb: hold a target_ops_ref in scoped_finish_thread_state
This commit fixes a use after free issue that was reported here:

  https://inbox.sourceware.org/gdb-patches/68354b98-795a-4b50-9eac-e54aa1d01b9d@simark.ca

This issue was exposed by the gdb.replay/missing-thread.exp test that
was added in this commit:

  commit 8bd08ee92c
  Date:   Fri May 16 17:56:58 2025 +0100

      gdb: crash if thread unexpectedly disappears from thread list

It is worth pointing out that the use after free issue existed before
this commit, this commit just introduced a test that exposed the issue
when GDB is run with the address sanitizer.

It has taken a while to get this fix ready for upstream as this fix
depended on the recently committed patch:

  commit 43db8f70d8
  Date:   Thu Oct 23 16:34:20 2025 +0100

      gdbsupport: remove undefined behaviour from (forward_)scope_exit

The problem is that the first commit above introduces a test which
causes the remote target to disconnect while processing an inferior
stop event, specifically, within normal_stop (infrun.c), GDB calls
update_thread_list, and it is during this call that the inferior
disconnects.

When the remote target disconnects, GDB immediately unpushes the
remote target.  See remote_unpush_target and its uses in remote.c.

If this is the last use of the remote target, then unpushing it will
cause the target to be deleted.

This is a problem, because in normal_stop, we have an RAII variable
maybe_finish_thread_state, which is an optional
scoped_finish_thread_state, and in some cases, this will hold a
pointer to the process_startum_target which needs to be finished.

So the order of events is:

  1. Call to normal_stop.

  2. Create maybe_finish_thread_state with a pointer to the current
     remote_target object.

  3. Call update_thread_list.

  4. Remote disconnects, GDB unpushes and deletes the current
     remote_target object.  GDB throws an exception.

  5. The exception propagates back to normal_stop.

  6. The destructor for maybe_finish_thread_state runs, and tries to
     make use of its cached pointer to the (now deleted) remote_target
     object.  Badness ensues.

This bug isn't restricted to normal_stop.  If a remote target
disconnects anywhere where there is a scoped_finish_thread_state in
the call stack then this issue could arise.

I think what we need to do is to ensure that the remote_target is not
actually deleted until after the scoped_finish_thread_state has been
cleaned up.

And so, to achieve this, I propose changing scoped_finish_thread_state
to hold a target_ops_ref rather than a pointer to the target_ops
object.  Holding the reference will prevent the object from being
deleted.

The new scoped_finish_thread_state is defined within its own file, and
is a drop in replacement for the existing class.

On my local machine the gdb.replay/missing-thread.exp test passes
cleanly after this commit (with address sanitizers), but when I test
on some other machines with a more recent Fedora install, I'm still
seeing test failures (both before and after this patch), though not
relating to the address sanitizer (at least, I don't see an error from
the sanitizer).  I don't think these other issues are directly related
to the problem being addressed in this commit, and so I'm proposing
this patch for inclusion anyway.  I'll continue to look at the test
and see if I can fix the other failures too.  Or maybe I'll end up
having to back out the test.

Approved-By: Simon Marchi <simon.marchi@efficios.com>
Reviewed-By: Guinevere Larsen <guinevere@redhat.com>
2026-01-07 11:10:54 +00:00
bfd Automatic date update in version.in 2026-01-07 00:00:07 +00:00
binutils Set ELF_OSABI for x86 and sparc 2026-01-04 19:30:16 +10:30
config tidy m4 plugin config support 2025-11-03 10:59:50 +10:30
contrib [contrib] Accept _("") and operator() in check_GNU_style_lib.py 2025-11-20 10:46:54 +01:00
cpu Add markers for 2.45 branch 2025-07-13 08:35:45 +01:00
elfcpp Update year range in copyright notice of binutils files 2026-01-01 23:22:14 +10:30
etc Update year range in copyright notice of binutils files 2026-01-01 23:22:14 +10:30
gas gas: dw2gencfi: reset reloc to TC_PARSE_CONS_RETURN_NONE for [su]leb128 2026-01-05 14:13:55 -08:00
gdb gdb: hold a target_ops_ref in scoped_finish_thread_state 2026-01-07 11:10:54 +00:00
gdbserver Update copyright dates to include 2026 2026-01-05 13:16:46 -07:00
gdbsupport [gdbsupport] Fix get_print_cell use in threads 2026-01-06 21:05:46 +01:00
gnulib gnulib: re-generate Makefile.in 2026-01-06 15:14:50 -05:00
gold Update year range in copyright notice of binutils files 2026-01-01 23:22:14 +10:30
gprof Update year range in copyright notice of binutils files 2026-01-01 23:22:14 +10:30
gprofng Update year range in copyright notice of binutils files 2026-01-01 23:22:14 +10:30
include aarch64: Add support for POE2 PLBI instruction 2026-01-05 17:50:55 +00:00
ld Improve the linker's --stats option to record memory use information provided by mallinfo(). 2026-01-07 10:45:22 +00:00
libbacktrace tidy m4 plugin config support 2025-11-03 10:59:50 +10:30
libctf Update year range in copyright notice of binutils files 2026-01-01 23:22:14 +10:30
libdecnumber regen config 2023-08-12 10:27:57 +09:30
libiberty Update year range in copyright notice of binutils files 2026-01-01 23:22:14 +10:30
libsframe libsframe: add README and mention expectations 2026-01-05 11:53:13 -08:00
opcodes aarch64: Add support for POE2 PLBI instruction 2026-01-05 17:50:55 +00:00
readline readline/tcap.h: Update definitions for C23 2025-05-02 12:00:05 -06:00
sim sim: re-generate Makefile.in 2026-01-06 15:15:02 -05:00
texinfo
zlib tidy m4 plugin config support 2025-11-03 10:59:50 +10:30
.cvsignore
.editorconfig toplevel: unify the GCC and GDB/binutils .editorconfig files 2025-10-01 16:20:29 +01:00
.gitattributes binutils-gdb/git: Handle *.ac and *.m4 files in .gitattributes 2025-12-18 10:00:54 +01:00
.gitignore Add Vim swap files to .gitignore 2025-02-28 16:06:25 +00:00
.pre-commit-config.yaml [pre-commit] Move tclint.toml settings to pyproject.toml 2026-01-05 18:30:49 +01:00
ar-lib
ChangeLog Add markers for 2.45 branch 2025-07-13 08:35:45 +01:00
compile
config-ml.in MSP430: Add -fno-exceptions multilib 2023-08-12 10:24:26 +09:30
config.guess Sync config.guess and config.sub with latest versions from the config project. 2025-01-17 10:18:30 +00:00
config.rpath
config.sub Sync config.guess and config.sub with latest versions from the config project. 2025-01-17 10:18:30 +00:00
configure Sync top-level with GCC 2025-11-03 09:53:04 +00:00
configure.ac Sync top-level with GCC 2025-11-03 09:53:04 +00:00
COPYING
COPYING.LIB
COPYING.LIBGLOSS
COPYING.NEWLIB
COPYING3
COPYING3.LIB
depcomp
djunpack.bat
install-sh
libtool.m4 Binutils/GCC: Add clang LTO support to AR, NM and RANLIB 2025-09-25 12:30:13 +08:00
ltgcc.m4
ltmain.sh ltmain.sh: allow more flags at link-time 2024-09-25 19:06:10 +01:00
ltoptions.m4
ltsugar.m4
ltversion.m4
lt~obsolete.m4
MAINTAINERS Fix compiling bfd/vms-lib.c for a 32-bit host. 2024-03-18 10:26:16 +00:00
Makefile.def Sync top-level with GCC 2025-11-03 09:53:04 +00:00
Makefile.in Sync toplevel files from gcc 2025-10-02 07:42:18 +08:00
Makefile.tpl Sync toplevel files from gcc 2025-10-02 07:42:18 +08:00
makefile.vms
missing
mkdep
mkinstalldirs
move-if-change
multilib.am
README README: don't talk about libg++ 2025-09-07 04:06:01 +01:00
README-maintainer-mode
SECURITY.txt Add a SECURITY.txt file describing the GNU Binutils' project's stance on security related bugs. 2023-04-20 16:52:11 +01:00
setup.com
src-release.sh Rename 'binutils' to 'binutils_with_gold'. Rename 'bin_no_gold' to 'binutils'. Add 'gold' 2025-02-04 11:50:02 +00:00
symlink-tree
test-driver
ylwrap

		   README for GNU development tools

This directory contains various GNU compilers, assemblers, linkers, 
debuggers, etc., plus their support routines, definitions, and documentation.

If you are receiving this as part of a GDB release, see the file gdb/README.
If with a binutils release, see binutils/README, and so on. That'll give you
info about this package -- supported targets, how to use it, how to report
bugs, etc.

It is now possible to automatically configure and build a variety of
tools with one command.  To build all of the tools contained herein,
run the ``configure'' script here, e.g.:

	./configure 
	make

To install them (by default in /usr/local/bin, /usr/local/lib, etc),
then do:
	make install

(If the configure script can't determine your type of computer, give it
the name as an argument, for instance ``./configure sun4''.  You can
use the script ``config.sub'' to test whether a name is recognized; if
it is, config.sub translates it to a triplet specifying CPU, vendor,
and OS.)

If you have more than one compiler on your system, it is often best to
explicitly set CC in the environment before running configure, and to
also set CC when running make.  For example (assuming sh/bash/ksh):

	CC=gcc ./configure
	make

A similar example using csh:

	setenv CC gcc
	./configure
	make

Much of the code and documentation enclosed is copyright by
the Free Software Foundation, Inc.  See the file COPYING or
COPYING.LIB in the various directories, for a description of the
GNU General Public License terms under which you can copy the files.

REPORTING BUGS: Again, see gdb/README, binutils/README, etc., for info
on where and how to report problems.