ASAN attach crash - 7.9 regression

-fsanitize=address
gdb.base/attach-pie-noexec.exp

==32586==ERROR: AddressSanitizer: heap-use-after-free on address 0x60200004ed90 at pc 0x48ad50 bp 0x7ffceb3aef50 sp 0x7ffceb3aef20
READ of size 2 at 0x60200004ed90 thread T0
    #0 0x48ad4f in __interceptor_strlen (/home/jkratoch/redhat/gdb-test-asan/gdb/gdb+0x48ad4f)
    #1 0xeafe5c in xstrdup xstrdup.c:33
    #2 0x85e024 in attach_command /home/jkratoch/redhat/gdb-test-asan/gdb/infcmd.c:2680

regressed by:

commit 6c4486e63f7583ed85a0c72841f6ccceebbf858e
Author: Pedro Alves <palves@redhat.com>
Date:   Fri Oct 17 13:31:26 2014 +0100
    PR gdb/17471: Repeating a background command makes it foreground

gdb/ChangeLog
2015-08-04  Jan Kratochvil  <jan.kratochvil@redhat.com>

	PR gdb/18767
	* infcmd.c (attach_command): Move ARGS_CHAIN cleanup after last ARGS
	use.

diff --git a/gdb/ChangeLog b/gdb/ChangeLog
index 5c51ae1..1062823 100644 (file)
--- a/gdb/ChangeLog
+++ b/gdb/ChangeLog
@@ -1,3 +1,9 @@
+2015-08-04  Jan Kratochvil  <jan.kratochvil@redhat.com>
+
+       PR gdb/18767
+       * infcmd.c (attach_command): Move ARGS_CHAIN cleanup after last ARGS
+       use.
+
 2015-08-04  Pedro Alves  <palves@redhat.com>
 
        * nat/gdb_thread_db.h (td_init_ftype, td_ta_new_ftype)

diff --git a/gdb/infcmd.c b/gdb/infcmd.c
index 4948d27..5cd8dd7 100644 (file)
--- a/gdb/infcmd.c
+++ b/gdb/infcmd.c
@@ -2617,9 +2617,6 @@ attach_command (char *args, int from_tty)
      shouldn't refer to attach_target again.  */
   attach_target = NULL;
 
-  /* Done with ARGS.  */
-  do_cleanups (args_chain);
-
   /* Set up the "saved terminal modes" of the inferior
      based on what modes we are starting it with.  */
   target_terminal_init ();
@@ -2684,12 +2681,19 @@ attach_command (char *args, int from_tty)
          a->async_exec = async_exec;
          add_inferior_continuation (attach_command_continuation, a,
                                     attach_command_continuation_free_args);
+
+         /* Done with ARGS.  */
+         do_cleanups (args_chain);
+
          return;
        }
 
       wait_for_inferior ();
     }
 
+  /* Done with ARGS.  */
+  do_cleanups (args_chain);
+
   attach_command_post_wait (args, from_tty, async_exec);
 }