Bug 311881
| Summary: | ptrace: i386 debugger + x86_64 kernel + threaded (i386) inferior = error | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 4 | Reporter: | Jan Kratochvil <jan.kratochvil> | ||||||
| Component: | kernel | Assignee: | Jerome Marchand <jmarchan> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Martin Jenner <mjenner> | ||||||
| Severity: | medium | Docs Contact: | |||||||
| Priority: | medium | ||||||||
| Version: | 4.0 | CC: | jbaron, roland | ||||||
| Target Milestone: | beta | Keywords: | EasyFix | ||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | RHSA-2008-0665 | Doc Type: | Bug Fix | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2008-07-24 19:17:35 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | 247427 | ||||||||
| Bug Blocks: | 430698 | ||||||||
| Attachments: |
|
||||||||
|
Description
Jan Kratochvil
2007-09-28 21:54:40 UTC
Created attachment 211021 [details]
Arbitrary pthread using testcase inferior.
More specific bugreport has been requested. Created attachment 212201 [details]
Standalone C testcase.
The problem is really in the x86_64 kernel for i386 processes using ptrace(2).
The attached testcase forks a child process, starts threading in it, checks its
%gs is !=0, AFTERWARDS the parent process starts ptrace(2)ing the child, reads
its %gs by PTRACE_PEEKUSER (offsetof (struct user, regs.gs)) and it reads _0_.
libthread_db is not used in this testcase.
libpthread is used but if it would leave %gs at 0 a different assertion check
would fail there.
Steps to Reproduce:
1. gcc -o x86_64-running-i386-debugger x86_64-running-i386-debugger.c -Wall
-ggdb2 -pthread -static-libgcc -m32; ./x86_64-running-i386-debugger; echo $?
Actual results:
x86_64-running-i386-debugger: x86_64-running-i386-debugger.c:149: main:
Assertion `gs_orig != 0' failed.
Aborted
134
Expected results:
0
Additional info:
Not required for the testcase above but %fs/%gs state on libpthread:
x86_64 host running i386 binary (no ptrace(2)/debugging involved):
main before pthread_create(): fs=0x0 gs=0x5b
main after pthread_create(): fs=0x0 gs=0x5b
thread: fs=0x0 gs=0x5b
i386 host running i386 binary (no ptrace(2)/debugging involved):
main before pthread_create(): fs=0x0 gs=0x33
main after pthread_create(): fs=0x0 gs=0x33
thread: fs=0x0 gs=0x33
Use upstream commit e8ed11b9dc07df0134248542ca8e7d40751a6052 This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release. I've tested the proposed patch and the testcase is still not successful. It fails in gs_to_idx because of an unexpected value of gs (0x5b - FS_TLS_SEL instead of GS_TLS_SEL?) [root@xxx ~]# gcc -o x86_64-running-i386-debugger x86_64-running-i386-debugger.c -Wall -ggdb2 -pthread -static-libgcc -m32; ./x86_64-running-i386-debugger; echo $? gs == 0x5b x86_64-running-i386-debugger: x86_64-running-i386-debugger.c:78: gs_to_idx: Assertion `0' failed. Aborted 134 Comment on attachment 212201 [details] Standalone C testcase. Jerome, you are right, only the testcase was incomplete. Up-to-date version (patched kernel-smp-2.6.9-68.20.EL.x86_64 PASSes there): http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/test s/x86_64-ia32-gs.c?cvsroot=systemtap Committed in 68.27.EL . RPMS are available at http://people.redhat.com/vgoyal/rhel4/ An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2008-0665.html |