From owner-freebsd-current@freebsd.org Tue Jul 12 01:16:11 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id AC917B835B2 for ; Tue, 12 Jul 2016 01:16:11 +0000 (UTC) (envelope-from markjdb@gmail.com) Received: from mail-pa0-x22d.google.com (mail-pa0-x22d.google.com [IPv6:2607:f8b0:400e:c03::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 7E57912D2 for ; Tue, 12 Jul 2016 01:16:11 +0000 (UTC) (envelope-from markjdb@gmail.com) Received: by mail-pa0-x22d.google.com with SMTP id hu1so585282pad.3 for ; Mon, 11 Jul 2016 18:16:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:subject:message-id:mime-version :content-disposition:user-agent; bh=rKkn31wP9EAYSGfKYpjpJt4vAputiCvbj2fed1TQ6is=; b=rNYGAmi35rBMsnVaBr4pyRmDBmc/Ok5Wqa/vujMAlakg0QRy/bDpAHkejGcwV7NKcr 9d4r6a6qzX5ZzLTBJUXXv0iFUaY68Bj5IQ0gJ65WB/YLlIprUI/fDwxTjVoPo6exnzH2 OA19ZP3Wz+OzFvc8lx9ODlBt9Vs4jdAViZF6kqrZYJr/XKcvj/K5Ei5yd4x8ph7ad3g5 IIZXQkQMq2lK40K5MHlkxqj2dSSbjl/55EzCf2w4dGdlN7z6IPJrfUJYRtmSlViPvLez 2I9Ofgibimfo/guSGNSszzyjlSitsoXKfpjRxYVOzzZd+gnDtkfLGbm2TxwdhadAqQM0 Px5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:sender:date:from:to:subject:message-id :mime-version:content-disposition:user-agent; bh=rKkn31wP9EAYSGfKYpjpJt4vAputiCvbj2fed1TQ6is=; b=R25fcffQx95jFn8X1HYK41NxF7DpRcR/7lIb18LZMK0hpiEG090yCEhw1G5GkEhakp AskB9z6O/sF9MbtYvaNuOb+RYB9mOPUg7u0H672zsvEPljnpVG38sXLjTLKX1b3yIhdy AEKkGjGQIaDLmI4tWqevYO5TyhTsQ3s/a773fu/HkeTdtJsqmh/0tM6IbAhKpUqtzYna JeYx8jlNL+3b+Ca/BOM928gycaySGqAcypn37FAKgYWnEfjwgqVI81HQkHT7do5Szivi IQobOjulBpSNVuMw1f2SgwQ6AYwrYyYJCTUleTGbCeXrvqP/AiHWrAHGvzvqieZ0qgoS L5fA== X-Gm-Message-State: ALyK8tK3eJQDyRmkZdQWYP5/XThrLPRBGtlYaDvXFM4lbtPnYojNLye4IvJCrzXxQRBnoQ== X-Received: by 10.66.236.133 with SMTP id uu5mr39614776pac.35.1468286170555; Mon, 11 Jul 2016 18:16:10 -0700 (PDT) Received: from wkstn-mjohnston.west.isilon.com (c-76-104-201-218.hsd1.wa.comcast.net. [76.104.201.218]) by smtp.gmail.com with ESMTPSA id cl15sm92690pac.15.2016.07.11.18.16.09 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 11 Jul 2016 18:16:10 -0700 (PDT) Sender: Mark Johnston Date: Mon, 11 Jul 2016 18:19:38 -0700 From: Mark Johnston To: freebsd-current@FreeBSD.org Subject: ptrace attach in multi-threaded processes Message-ID: <20160712011938.GA51319@wkstn-mjohnston.west.isilon.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.6.1 (2016-04-27) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Jul 2016 01:16:11 -0000 Hi, It seems to be possible for ptrace(PT_ATTACH) to race with the delivery of a signal to the same process. ptrace(PT_ATTACH) sets P_TRACED and sends SIGSTOP to a thread in the target process. Consider the case where a signal is delivered to a second thread, and both threads are executing ast() concurrently. The two threads will both call issignal() and from there call ptracestop() because P_TRACED is set, though they will be serialized by the proc lock. If the thread receiving SIGSTOP wins the race, it will suspend first and set p->p_xthread. The second thread will also suspend in ptracestop(), overwriting the p_xthread field set by the first thread. Later, ptrace(PT_DETACH) will unsuspend the threads, but it will set td->td_xsig only in the second thread. This means that the first thread will return SIGSTOP from ptracestop() and subsequently suspend the process, which seems rather incorrect. The above is just a theory to explain an unexpectedly-stopped multi-threaded process that I've observed. Is there some mechanism I'm missing that prevents multiple threads from suspending in ptracestop() at the same time? If not, then I think that's the root of the problem, since p_xthread is pretty clearly not meant to be overwritten this way. Moreover, in my scenario I see a thread with TDB_XSIG set even after ptrace(PT_DETACH) was called (P_TRACED is cleared). Thanks, -Mark