Messages in this thread | | | Date | Thu, 11 Feb 2010 13:56:07 +0100 | From | Oleg Nesterov <> | Subject | Re: Race in ptrace. |
| |
On 02/10, Salman Qazi wrote: > > I have > made a simpler version of tavis's test case:
Thanks, now I see what you mean.
But this all is correct, you can't expect PTRACE_SYSCALL can succeed is the tracee is running, it must be stopped or traced.
The tracee is running because it was TASK_STOPPED and antagonist() sends SIGCONT.
The tracee was TASK_STOPPED because the tracer passes sig = SIGSTOP via ptrace(PTRACE_SYSCALL, WSTOPSIG(status).
Where do you see the bug?
OK, let me simplify the test-case even more:
int main(void) { int stat, ret; int pid = fork();
if (!pid) { ptrace(PTRACE_TRACEME, 0, NULL, NULL); for (;;) ; }
sleep(1); // wait for PTRACE_TRACEME kill(pid, SIGSTOP);
// the child reports SIGSTOP, it is TASK_TRACED assert(pid == wait(&stat) && WIFSTOPPED(stat));
// the tracee should stop, we pass sig = SIGSTOP assert(ptrace(PTRACE_SYSCALL, pid, 0, WSTOPSIG(stat)) == 0);
// the child reports the group stop, it is TASK_STOPPED assert(pid == wait(&stat) && WIFSTOPPED(stat));
// the tracee is STOPPED as requested, not TRACED, // SIGCONT wakes it up kill(pid, SIGCONT);
// now the tracee is _running_, and PTRACE_SYSCALL must fail ret = ptrace(PTRACE_SYSCALL, pid, 0, WSTOPSIG(stat)); printf("should fail: ret=%d %m\n", ret);
return 0; }
PTRACE_SYSCALL fails, and this is absolutely correct.
Now, let's look at your test-case
> int main(int argc, char **argv) > { > int status; > assert((child_pid = do_fork(child)) > 0); > assert((ant_pid = do_fork(antagonist)) > 0); > waitpid(child_pid, &status, 0); > ptrace(PTRACE_SYSCALL, child_pid, NULL, NULL); > while(1) { > if (waitpid(child_pid, &status, 0) <= 0) { > printf("Errno %d\n", errno); > exit(EXIT_FAILURE); > } > if (WIFSTOPPED(status)) {
WSTOPSIG() should be either SIGCONT or SIGSTOP
> printf("stopped: %d\n", WSTOPSIG(status)); > > /* This should work, but sometimes it doesn't */ > if (ptrace(PTRACE_SYSCALL, child_pid, > NULL, WSTOPSIG(status)) < 0) {
This should not work if the tracee reported the group stop (not the fact it dequeued SIGSTOP) and antagonist() sends SIGCONT in between.
> /* Oddly it works the second time! */ > assert (ptrace(PTRACE_SYSCALL, > child_pid, NULL, WSTOPSIG(status)) < 0);
Of couse, it _can_ work the second time, antagonist() sends a signal (SIGCONT or SIGSTOP), the tracee dequeues the signal, and stops to report this signal.
See?
Oleg.
| |