DynamoRIO / DynamoRIO/dynamorio
CRASH from race on detach in LOG debug-build code
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
While testing a fix for #3535, running debug build I hit this crash maybe once in 100 runs:
```
#4 0x00007fe6e8f590a5 in getchar () at getchar.c:37
#5 0x00005640f8054db3 in handle_signal (signal=11, siginfo=0x7fe6e56cff30, ucxt=0x7fe6e56cfe00) at /home/bruening/dr/git/src/suite/tests/api/detach_signal.cpp:105
#6
#7 0x00007fe6e93d1c72 in master_signal_handler_C (sig=7, siginfo=0x7fe6e56d0770, ucxt=0x7fe6e56d0640, xsp=0x7fe6e56d0638 ";\016\071\351\346\177") at /home/bruening/dr/git/src/core/unix/signal.c:5107
0x00007fe6e93d1c59 <+1004>: lea 0x161388(%rip),%rax # 0x7fe6e9532fe8
0x00007fe6e93d1c60 <+1011>: mov (%rax),%rax
0x00007fe6e93d1c63 <+1014>: test %rax,%rax
0x00007fe6e93d1c66 <+1017>: je 0x7fe6e93d1ccc
0x00007fe6e93d1c68 <+1019>: lea 0x161379(%rip),%rax # 0x7fe6e9532fe8
0x00007fe6e93d1c6f <+1026>: mov (%rax),%rax
==>
0x00007fe6e93d1c72 <+1029>: mov 0x218(%rax),%eax
0x00007fe6e93d1c78 <+1035>: test %eax,%eax
0x00007fe6e93d1c7a <+1037>: je 0x7fe6e93d1ccc
0x00007fe6e93d1c7c <+1039>: lea 0x161365(%rip),%rax # 0x7fe6e9532fe8
0x00007fe6e93d1c83 <+1046>: mov (%rax),%rax
0x00007fe6e93d1c86 <+1049>: mov 0x214(%rax),%eax
0x00007fe6e93d1c8c <+1055>: and $0x10,%eax
0x00007fe6e93d1c8f <+1058>: test %eax,%eax
0x00007fe6e93d1c91 <+1060>: je 0x7fe6e93d1ccc
0x00007fe6e93d1c93 <+1062>: callq 0x7fe6e93ae109
(gdb) p &((dr_statistics_t*)0)->loglevel
$2 = (uint *) 0x218
(gdb) p d_r_stats
$3 = (dr_statistics_t *) 0x0
```
Must be a race where d_r_stats is set to NULL in between the check for NULL and
the de-ref of loglevel.
I was not planning to fix it: b/c it would require eliminating all LOG calls on detach paths, which are useful for debugging, and b/c it is limited to debug build.
Contributor guide
Research direction
Start with src/core/unix/signal.c around master_signal_handler_C and the d_r_stats access shown in the trace. Reproduce the crash using the debug build and suite/tests/api/detach_signal.cpp, especially handle_signal at line 105. Done means the detach race no longer causes the signal handler to crash while preserving useful debug-path logging.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100