lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 06 Jun 2007 14:47:54 +0900
From:	Satoru Takeuchi <takeuchi_satoru@...fujitsu.com>
To:	Linux Kernel <linux-kernel@...r.kernel.org>,
	Linus Torvalds <torvalds@...l.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Cc:	Satoru Takeuchi <takeuchi_satoru@...fujitsu.com>
Subject: [BUG] ptraced process waiting on syscall may return kernel internal errnos

Hi,

If there is a multithread process which is waiting on restartable syscall
and ptraced, some threads may return from syscalls with a errno which should
never be seen by user programs when they receive SIGSTOP. It is not a rare
case beacuse strace send SIGSTOP to attached process on its exit (e.g. on
receiving SIGINT from terminal).

I found this problem on 2.6.22-rc3 and I also confirmed 2.6.22-rc4 has same
problem. Probably this bug is in generic signal code because this problem
occurs on both i386 box and ia64 box.

This bug is very easy to recreate and I don't know whether or not the problem
has some relation with the following bug which reported recently by Benjamin
Herrenschmidt.

	http://lkml.org/lkml/2007/6/4/468

I executed this recreate program on 2.6.22-rc4 with the following Linus's
patch and this bug also occured.

	http://lkml.org/lkml/2007/6/4/471

For more details, please refer to the attached recreate program.



BTW, I found one more strace related bug. I'll report it soon...

Thanks,
Satoru

-------------------------------------------------------------------------------
/*
 * recreate-signal-mt-ptrace-bug-pipe - recreate a signal bug.
 *
 * ---------------------------------------------------------------------------
 * 
 * Problem
 * =======
 *
 * If there is a multithread process which is in restartable syscall and
 * ptraced, some threads may return from syscalls with a errno which should
 * never be seen by user programs when they receive SIGSTOP. It is not a
 * rare case beacuse strace send SIGSTOP to attached process on its exit.
 *
 * How to recreate
 * ===============
 *
 * 1. run this program
 * 
 *    $ ./recreate-signal-mt-ptrace-bug-pipe &
 * 
 * 2. run strace and attach this program
 *
 *    $ strace -f -p $!
 *
 * 3. C-c on terminal (*1)
 *
 * (*1) Directly send SIGSTOP to ./recreate-signal-mt-ptrace-bug-pipe is
 *      also OK
 *
 * Expected Result
 * ===============
 *
 * All threads of this program was detached safely
 * 
 * Actual Result
 * =============
 *
 * Some threads may return from read() with ERESTARTSYS and print the
 * following message.
 *
 *	read() failed with errno 512
 * 
 * Note
 * ====
 *
 * This program can't always recreate a problem. However recreate
 * possibility is very high.
 * 
 *----------------------------------------------------------------------
 * 
 * Copyright 2007 Satoru Takeuchi <takeuchi_satoru@...futjisu.com>
 *
 * This software may be used and distributed according to the terms
 * of the GNU General Public License, incorporated herein by reference.
 * 
 */

#include <unistd.h>
#include <sys/types.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <err.h>

static int fd[2];

void *thread_fn(void *arg)
{
	char c;

	if (read(fd[0], &c, sizeof(char)) < 0)
		err(EXIT_FAILURE, "read() failed with errno %d\n", errno);
	
	return NULL;
}

#define NTHREAD 64

int main(int argc, char **argv)
{
	pthread_t t[NTHREAD];
	int i;

	if (pipe(fd) < 0)
		err(EXIT_FAILURE, "pipe() failed");

	for (i = 0; i < NTHREAD; i++)
		if (pthread_create(&t[i], NULL, thread_fn, NULL)) {
			warn("pthread_create() failed\n");
			exit(EXIT_FAILURE);
		}

	for (i = 0; i < NTHREAD; i++)
		if (!pthread_join(t[i], NULL))
			warn("pthread_join() failed");

	exit(EXIT_SUCCESS);
}
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ