linux-kernel - Bug: ptrace issues under x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <3e8340490903252341u55abbc3aree9afc1b0a7703e6@mail.gmail.com>
Date:	Thu, 26 Mar 2009 02:41:14 -0400
From:	Bryan Donlan <bdonlan@...il.com>
To:	LKML <linux-kernel@...r.kernel.org>, xen-devel@...ts.xensource.com
Subject: Bug: ptrace issues under x86_64 Xen kernel 2.6.29

Using 2.6.29 or 2.6.28 as a 64-bit Xen domU, a number of ptrace()
users seem to have issues with unexpected breakpoints. ltrace and gdb
both seem to be affected, under both 64-bit and 32-bit userspace.
32-bit kernels do not seem to be affected. Typical symptoms look like:

x86 li63-205:/# ltrace /bin/true
unexpected breakpoint at 0xf7e6d89f
unexpected breakpoint at 0xf7e60a3f
unexpected breakpoint at 0xf7e6464f
unexpected breakpoint at 0x804933f
unexpected breakpoint at 0xf7ea509f
unexpected breakpoint at 0xf7e9b1ff
unexpected breakpoint at 0xf7efef66
+++ exited (status 0) +++

x64 li63-205:~/linux-2.6# ltrace true
unexpected breakpoint at 0x7f3379878f1f
unexpected breakpoint at 0x7f337986ca3f
unexpected breakpoint at 0x7f337986fd3f
unexpected breakpoint at 0x402bdf
unexpected breakpoint at 0x7f33798b07bf
unexpected breakpoint at 0x7f33798a696f
unexpected breakpoint at 0x7f3379905e3f
+++ exited (status 0) +++

li63-205:~# gdb /bin/true
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu"...
(no debugging symbols found)
(gdb) run
Starting program: /bin/true
(no debugging symbols found)
(no debugging symbols found)

Program received signal SIGTRAP, Trace/breakpoint trap.
0x00007f640680e4e7 in ?? () from /lib64/ld-linux-x86-64.so.2
(gdb)

In the specific case of the above gdb session, here is /proc/pid/maps
from the tracee:
00400000-00407000 r-xp 00000000 ca:00 9531
  /bin/true
00607000-00608000 rw-p 00007000 ca:00 9531
  /bin/true
7f64067f9000-7f6406816000 r-xp 00000000 ca:00 1678
  /lib/ld-2.9.so
7f6406a12000-7f6406a15000 rw-p 7f6406a12000 00:00 0
7f6406a15000-7f6406a17000 rw-p 0001c000 ca:00 1678
  /lib/ld-2.9.so
7fff0ea01000-7fff0ea16000 rw-p 7ffffffea000 00:00 0                      [stack]
7fff0ebfe000-7fff0ebff000 r-xp 7fff0ebfe000 00:00 0                      [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
  [vsyscall]

strace seems(?) to be unaffected.

I've attached my .config, dmesg, and strace output for running ltrace
(32-bit) on /bin/true on the affected system. Unfortunately, I'm not
enough of a ptrace guru to interpret what the cause might be.

Download attachment "config" of type "application/octet-stream" (34098 bytes)

Download attachment "dmesg-out" of type "application/octet-stream" (8836 bytes)

Download attachment "broken-trace" of type "application/octet-stream" (24076 bytes)