linux-kernel - Re: Unkillable processes due to PTRACE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20161205165957.GA13035@redhat.com>
Date:   Mon, 5 Dec 2016 17:59:58 +0100
From:   Oleg Nesterov <oleg@...hat.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     Pavel Machek <pavel@....cz>, Denys Vlasenko <dvlasenk@...hat.com>,
        jan.kratochvil@...hat.com, palves@...hat.com,
        Roland McGrath <roland@...k.frob.com>,
        syzkaller <syzkaller@...glegroups.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: Unkillable processes due to PTRACE_TRACEME again

On 12/05, Dmitry Vyukov wrote:
>
> On Mon, Dec 5, 2016 at 12:00 PM, Oleg Nesterov <oleg@...hat.com> wrote:
> > On 12/05, Oleg Nesterov wrote:
> >>
> >> On 12/02, Dmitry Vyukov wrote:
> >> >
> >> > I am not on 2caceb3294a78c389b462e7e236a4e744a53a474 (Dec 1). And see
> >> > the same unwaitable zombie processes.
> >>
> >> This is another thing, and notabug. This is how ptrace works,
> >>
> >> > void *thr(void *arg)
> >> > {
> >> >   ptrace(PTRACE_TRACEME, 0, 0, 0);
> >> > }
> >> >
> >> > int main()
> >> > {
> >> >   int pid = fork();
> >> >   if (pid == 0) {
> >> >     pthread_t th;
> >> >     pthread_create(&th, 0, thr, 0);
> >> >     usleep(100000);
> >> >     exit(0);
> >> >   }
> >> >   usleep(200000);
> >> >   kill(pid, SIGKILL);
> >> >   int status = 0;
> >> >   waitpid(pid, &status, __WALL);
> >>
> >> waitpid(pid) hangs because you need to reap the sub-thread first.
> >
> > I'm afraid I wasn't clear...
> >
> > So the child process has 2 threads, the leader thread L and the sub-thread T.
> > waitpid(pid == L->pid) will block until all the threads go away, but since T is
> > traced it won't autoreap, the tracer should do waitpid(T->pid) first to reap
> > this zombie. waitpid(-1) should work too.
> 
> Do you mean that I need to replace:
>  waitpid(pid, &status, __WALL);
> with:
>  while (waitpid(-1, &status, __WALL) != pid) {}
> ?

Yes. Or, if you knew the pid of the traced thread you could do

	// need to do this first, the traced sub-thread won't autoreap,
	// and the leader which represents the whole process is not reapable
	// until all other threads go away
	waitpid(tracee_pid, &status, __WALL);

	waitpid(pid, &status, __WALL);

Oleg.