]> git.ipfire.org Git - thirdparty/binutils-gdb.git/commit
gdb/remote: use current_inferior in read_ptid if multi-process not supported
authorTankut Baris Aktemur <tankut.baris.aktemur@intel.com>
Tue, 29 Mar 2022 14:19:10 +0000 (16:19 +0200)
committerTankut Baris Aktemur <tankut.baris.aktemur@intel.com>
Tue, 29 Mar 2022 14:19:10 +0000 (16:19 +0200)
commit2f761de2bab729dcd010057f153d73f2c01396b4
treeb69226909471feeb222aaf5fee731f11a57481b7
parent47b8bb38fcb8ea1df70a932f7fe9fedca8993ec7
gdb/remote: use current_inferior in read_ptid if multi-process not supported

When parsing the ptid out of a reply package, if the multi-process
extensions are not supported, use current_inferior's pid as the pid of
the reported thread, instead of inferior_ptid.  This is needed because
the inferior_ptid may be null_ptid although a legit context exists,
due to a prior context switch via switch_to_inferior_no_thread.

Below is a scenario that illustrates what could go wrong.  First,
setup a multi-target scenario.  This is needed, because in a
multi-target setting, the inferior_ptid is cleared out before waiting
on targets.  The second inferior below sits on top of a remote target.
Multi-process packets are disabled.

  $ # First, spawn a process with PID 26253 to attach to later.
  $ gdb-up a.out
  Reading symbols from a.out...
  (gdb) maint set target-non-stop on
  (gdb) set remote multiprocess-feature-packet off
  (gdb) start
  ...
  (gdb) add-inferior -no-connection
  [New inferior 2]
  Added inferior 2
  (gdb) inferior 2
  [Switching to inferior 2 [<null>] (<noexec>)]
  (gdb) target extended-remote | gdbserver --multi -
  Remote debugging using | gdbserver --multi -
  Remote debugging using stdio
  (gdb) attach 26253
  Attaching to Remote target
  Attached; pid = 26253
  [New Thread 26253]
  [New inferior 3]
  Reading /tmp/a.out from remote target...
  ...
  [New Thread 26253]
  ...
  Reading /usr/local/lib/debug/....debug from remote target...
  >>> GDB seems to hang here.

After attaching to a process and reading some library files, GDB
seems to hang.  One interesting thing to note is that

  [New Thread 26253]

appears twice.  We also see

  [New inferior 3]

Running the same scenario with "debug infrun on" reveals more details.

  ...
  (gdb) attach 26253
  [infrun] scoped_disable_commit_resumed: reason=attaching
  Attaching to Remote target
  Attached; pid = 26253
  [New Thread 26253]
  [infrun] infrun_async: enable=1
  [infrun] attach_command: immediately after attach:
  [infrun] attach_command:   thread 26253.26253.0, executing = 1, resumed = 0, state = RUNNING
  [infrun] clear_proceed_status_thread: 26253.26253.0
  [infrun] reset: reason=attaching
  [infrun] maybe_set_commit_resumed_all_targets: not requesting commit-resumed for target native, no resumed threads
  [infrun] maybe_set_commit_resumed_all_targets: enabling commit-resumed for target extended-remote
  [infrun] fetch_inferior_event: enter
    [infrun] scoped_disable_commit_resumed: reason=handling event
    [infrun] do_target_wait: Found 2 inferiors, starting at #1
    [infrun] random_pending_event_thread: None found.
    [infrun] print_target_wait_results: target_wait (-1.0.0 [Thread 0], status) =
    [infrun] print_target_wait_results:   26253.26253.0 [Thread 26253],
    [infrun] print_target_wait_results:   status->kind = STOPPED, sig = GDB_SIGNAL_0
    [infrun] handle_inferior_event: status->kind = STOPPED, sig = GDB_SIGNAL_0
    [infrun] start_step_over: enter
      [infrun] start_step_over: stealing global queue of threads to step, length = 0
      [infrun] operator(): step-over queue now empty
    [infrun] start_step_over: exit
    [infrun] context_switch: Switching context from 0.0.0 to 26253.26253.0
    [infrun] handle_signal_stop: stop_pc=0x7f849d8cf151
    [infrun] stop_waiting: stop_waiting
    [infrun] stop_all_threads: starting
    [infrun] stop_all_threads: pass=0, iterations=0
  [New inferior 3]
  Reading /tmp/a.out from remote target...
  warning: File transfers from remote targets can be slow. Use "set sysroot" to access files locally instead.
  Reading /tmp/a.out from remote target...
  Reading symbols from target:/tmp/a.out...
  [New Thread 26253]
    [infrun] stop_all_threads:   4723.4723.0 not executing
    [infrun] stop_all_threads:   26253.26253.0 not executing
    [infrun] stop_all_threads:   42000.26253.0 executing, need stop
    [infrun] print_target_wait_results: target_wait (-1.0.0 [Thread 0], status) =
    [infrun] print_target_wait_results:   -1.0.0 [Thread 0],
    [infrun] print_target_wait_results:   status->kind = IGNORE
    [infrun] print_target_wait_results: target_wait (-1.0.0 [Thread 0], status) =
    [infrun] print_target_wait_results:   -1.0.0 [Thread 0],
    [infrun] print_target_wait_results:   status->kind = IGNORE

GDB tried to stop Thread 42000.26253.0, which does not exist, and we
are waiting for a stop event that will never happen.  The PID in
'42000.26253.0', namely 42000, is the PID of magic_null_ptid.
It comes from gdb/remote.c:read_ptid:

  /* Since the stub is not sending a process id, then default to
     what's in inferior_ptid, unless it's null at this point.  If so,
     then since there's no way to know the pid of the reported
     threads, use the magic number.  */
  if (inferior_ptid == null_ptid)
    pid = magic_null_ptid.pid ();
  else
    pid = inferior_ptid.pid ();

  if (obuf)
    *obuf = pp;
  return ptid_t (pid, tid);

Because multi-process was turned off, GDB did not parse an explicitly
specified PID.  Furthermore, inferior_ptid == null_ptid, and
eventually GDB picked the PID from magic_null_ptid.

If target-non-stop is not turned on at the beginning, the same bug
reveals itself as a duplicated thread as shown below.

  # Same setup as above, without 'maint set target-non-stop on'.
  ...
  (gdb) attach 26253
  Attaching to Remote target
  Attached; pid = 26253
  [New inferior 3]
  ...
  [New Thread 26253]
  ...
  (gdb) info threads
    Id   Target Id             Frame
    1.1  process 13517 "a.out" main () at test.c:3
  * 2.1  Thread 26253 "a.out"  0x00007f12750c5151 in read () from target:/lib/x86_64-linux-gnu/libc.so.6
    3.1  Thread 26253 "a.out"  Remote 'g' packet reply is too long (expected 560 bytes, got 2496 bytes): 00feffffffffffff000a3a75127f000051510c75127f0000000400000000000060d24ef6af5500000000000000000000680d000000000000b85b31e3fc7f0000c0283a75127f000000e55b75127f000010d04ef6af550000460200000000000060c73975127f0000a0d23975127f0000000a3a75127f0000000000000000000051510c75127f000046020000330000002b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007f03000000000000ffff0000000000000000000000000000000000000000000080143a75127f000080143a75127f000040143a75127f000040143a75127f00007d0000007e0000007f00000080000000300c3a75127f0000300c3a75127f00000e000000000000000e0000000000000000000000000000000000000000000000ffffffffffffffffffffffffffffffff0400000004000000040000000400000020143a75127f000020143a75127f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000801f0000000000000000000000e55b75127f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  (gdb)

Fix the problem by preferring current_inferior()'s pid instead of
magic_null_ptid.

Regression-tested on X86-64 Linux.

Co-authored-by: Aleksandar Paunovic <aleksandar.paunovic@intel.com>
gdb/remote.c
gdb/testsuite/gdb.multi/attach-no-multi-process.c [new file with mode: 0644]
gdb/testsuite/gdb.multi/attach-no-multi-process.exp [new file with mode: 0644]