[Bug python/34302] New: gdb internal error when python runs `info program` during vfork detach

https://sourceware.org/bugzilla/show_bug.cgi?id=34302

            Bug ID: 34302
           Summary: gdb internal error when python runs `info program`
                    during vfork detach
           Product: gdb
           Version: HEAD
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: python
          Assignee: unassigned at sourceware dot org
          Reporter: k4lizen at proton dot me
  Target Milestone: ---

The reproducer for the bug and analysis can be found here:
https://sourceware.org/bugzilla/show_bug.cgi?id=34047

Reproducer:
```bash
$ docker run -it --security-opt seccomp=unconfined
ghcr.io/pwndbg/pwndbg:ubuntu24.04 /bin/bash
# cd ~
# apt update && apt install -y tmux 7zip
# wget https://files.catbox.moe/fg6zkn.7z
# 7z x fg6zkn.7z -psooreproducable
# tmux
$ ./exploit.py
pwndbg> break __spawni_child
pwndbg> continue
pwndbg> continue
```

Analysis by Simon Marchi:
(see linked bug for backtraces)
====
The problem looks like:

 - inf 1 vforks, creating inf 2, and we want to detach from inf 1
 - handle_vfork_child_exec_or_exit purposefully sets inf 2's pspace to nullptr
while detaching inf 1, as explained here:

  
https://gitlab.com/gnutools/binutils-gdb/-/blob/cd05beed352d69e282e9fae6f69bfec48a8faedf/gdb/infrun.c#L1118
 - while detaching, the inferior_disappeared observer gets called, which sends
the Python "inferior exited" event
 - the Python code calls "info program"
 - the handler for "info program" obtains a thread using get_previous_thread(),
which returns a thread from inf 2
 - it tries to switch to that thread, which tries to set that inferior's pspace
as the current program space, and because it is nullptr the assert triggers
====

-- 
You are receiving this mail because:
You are on the CC list for the bug.