Date: Mon, 11 Jul 2016 18:19:38 -0700 From: Mark Johnston <markj@FreeBSD.org> To: freebsd-current@FreeBSD.org Subject: ptrace attach in multi-threaded processes Message-ID: <20160712011938.GA51319@wkstn-mjohnston.west.isilon.com>
next in thread | raw e-mail | index | archive | help
Hi, It seems to be possible for ptrace(PT_ATTACH) to race with the delivery of a signal to the same process. ptrace(PT_ATTACH) sets P_TRACED and sends SIGSTOP to a thread in the target process. Consider the case where a signal is delivered to a second thread, and both threads are executing ast() concurrently. The two threads will both call issignal() and from there call ptracestop() because P_TRACED is set, though they will be serialized by the proc lock. If the thread receiving SIGSTOP wins the race, it will suspend first and set p->p_xthread. The second thread will also suspend in ptracestop(), overwriting the p_xthread field set by the first thread. Later, ptrace(PT_DETACH) will unsuspend the threads, but it will set td->td_xsig only in the second thread. This means that the first thread will return SIGSTOP from ptracestop() and subsequently suspend the process, which seems rather incorrect. The above is just a theory to explain an unexpectedly-stopped multi-threaded process that I've observed. Is there some mechanism I'm missing that prevents multiple threads from suspending in ptracestop() at the same time? If not, then I think that's the root of the problem, since p_xthread is pretty clearly not meant to be overwritten this way. Moreover, in my scenario I see a thread with TDB_XSIG set even after ptrace(PT_DETACH) was called (P_TRACED is cleared). Thanks, -Mark
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20160712011938.GA51319>