DynamoRIO / DynamoRIO/dynamorio

SIGSEGV loop in signal handler when DR is setup but there's no thread-private dcontext

Open
#2,664 0 comments 0 reactions 0 assignees View on GitHub
Bug-DRCrash OpSys-Linux
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

I discovered this when investigating a segfault in drcachesim (https://github.com/DynamoRIO/dynamorio/issues/2663). If there is a segfault in normal application code after DR's signal handler has been installed and when there's no specific `dcontext` set for that thread, the signal handler itself will segfault. This causes an infinite segfault loop.

When `get_thread_private_dcontext` returns NULL, the `dcontext` is set to `GLOBAL_CONTEXT` [0]. Later in the function, a field on the `dcontext` is accessed [1], which causes a segfault and causes the signal handler to be called again.

[0] https://github.com/DynamoRIO/dynamorio/blob/35a6c54/core/unix/signal.c#L4542
[1] https://github.com/DynamoRIO/dynamorio/blob/35a6c54/core/unix/signal.c#L4688

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.