Bug 133590 - PTRACE_ATTACH race with real parent's wait calls can produced bogus wait returns
Summary: PTRACE_ATTACH race with real parent's wait calls can produced bogus wait returns
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: All
OS: Linux
medium
low
Target Milestone: ---
Assignee: Roland McGrath
QA Contact: Brian Brock
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2004-09-24 23:02 UTC by Roland McGrath
Modified: 2007-11-30 22:10 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2005-01-03 08:32:36 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
test program to reproduce the bug (1.43 KB, text/plain)
2004-09-24 23:03 UTC, Roland McGrath
no flags Details
upstream 2.6 patch to avoid this race (985 bytes, patch)
2004-09-24 23:10 UTC, Roland McGrath
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2005:420 0 normal SHIPPED_LIVE Important: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 1 2005-06-08 04:00:00 UTC

Description Roland McGrath 2004-09-24 23:02:15 UTC
Description of problem:
There is a race between PTRACE_ATTACH and the real parent calling
wait.  For a moment, the task is put in PT_PTRACED but with its parent
still pointing to its real_parent.  In this circumstance, if the real
parent calls wait without the WUNTRACED flag, he can see a stopped
child status, which wait should never return without WUNTRACED when
the caller is not using ptrace.  Here it is not the caller that is
using ptrace, but some third party.

 

Version-Release number of selected component (if applicable):
2.6.9-rc2

How reproducible:
Requires SMP or preemption, hits pretty quickly on my 2-CPU test box.

Steps to Reproduce:
1. See attached test program.
2. compile it
3. run it
  
Actual results:
Eventually prints "wait => PID status 137f ..." and then gets
confused.  This happens when wait returns for the stopped child, which
should not be possible.

Expected results:
That should not happen.

Additional info:
Fix on the way

Comment 1 Roland McGrath 2004-09-24 23:03:00 UTC
Created attachment 104297 [details]
test program to reproduce the bug

Just compile and run it.

Comment 2 Roland McGrath 2004-09-24 23:10:11 UTC
Created attachment 104298 [details]
upstream 2.6 patch to avoid this race

I've submitted this patch upstream, waiting for feedback.

Comment 3 Roland McGrath 2004-10-29 19:44:21 UTC
This patch has gone in upstream, should be in 2.6.10.

Comment 4 Roland McGrath 2005-01-03 08:32:36 UTC
2.6.10 has this fixed.

Comment 5 Tim Powers 2005-06-08 15:12:36 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-420.html



Note You need to log in before you can comment on or make changes to this bug.