linux-kernel - Re: Weirdness in /proc/<pid>/maps and /proc/<pid>/stat.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1272403129.29233.20.camel@wall-e.seibold.net>
Date:	Tue, 27 Apr 2010 23:18:49 +0200
From:	Stefani Seibold <stefani@...bold.net>
To:	Robin Holt <holt@....com>
Cc:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	linux-kernel@...r.kernel.org
Subject: Re: Weirdness in /proc/<pid>/maps and /proc/<pid>/stat.

Am Dienstag, den 27.04.2010, 13:53 -0500 schrieb Robin Holt:
> With commit d899bf7b, the behavior of field 28 of /proc/<pid>/stat
> was changed as was /proc/<pid>/maps.  I don't know if that change was
> correct, but its resulting behavior is much more difficult to explain.
> I was wondering if we could determine what the "correct" behavior is
> before I spend much more time trying to give it the wrong behavior.
> 
> My test program is attached below.  Essentially:
> fork() -> pthread_create() -> fork()
> 
> x86_64 2.6.32 stable kernel:
> Step			stat-28		maps-threadstack
> p (parent)		0x7fff5607ddc0	N/A
> c (child)		0x7fff55c7dc50	N/A
> ppthread		0x7f2cf5c9bff0	0x7f2cf5c9d000:007feff0
> ppthread+fork		0x7f2cf589be30	0x7f2cf5c9d000:003fee30
> cpthread		0x7f2cf589be30  0x7f2cf5c9d000:007feff0
> cpthread+fork		0x7f2cf589be30	0x7f2cf5c9d000:003fee30

I must guess, because the output of your example code does not fit to
your description. But the stat-28 make sense for me. A thread gets a new
stack, a fork inherits the stack of the process. 

> Note: For all of the above, the /proc/<pids>/task/*/maps files had the
> stack line like:
> 7fff55c7d000-7fff56081000 rw-p 00000000 00:00 0                         [stack]
> 

This should be okay, because this is the stack of the main thread. The
stack of the thread is marked as [thread stack: xxxxxxxx]. Where
xxxxxxxx is the max size of the stack, because the thread stack could
start at a arbitrary position inside the VMA.

> The problems I see are:
> 1)  In the fork() case, we are using the current userland stack
>     pointer for task->stack_start.  This appears wrong as the
>     function which called fork() may be returned to and may
>     further return to higher level callers, finding sp now
>     beyond the value reported in /proc/self/stat.  Additionally,
>     the value reported for the child of the fork has no relationship
>     to the stack size rlimit any longer.
> 
> 2)  In the pthread + fork case, in addition to the problem
>     above, the size information in /proc/self/maps
>     is incorrect as it does not take into consideration
>     the same return paths.
> 
> The problem I am running into is coming up with any way to
> make the task->stack_start value usable.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/