DynamoRIO / DynamoRIO/dynamorio

CRASH from race on detach in LOG debug-build code

Open
#4,641 1 comment 0 reactions 0 assignees View on GitHub
Bug-DRCrash OpSys-UNIX Priority-Low
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

While testing a fix for #3535, running debug build I hit this crash maybe once in 100 runs:

```
#4 0x00007fe6e8f590a5 in getchar () at getchar.c:37
#5 0x00005640f8054db3 in handle_signal (signal=11, siginfo=0x7fe6e56cff30, ucxt=0x7fe6e56cfe00) at /home/bruening/dr/git/src/suite/tests/api/detach_signal.cpp:105
#6
#7 0x00007fe6e93d1c72 in master_signal_handler_C (sig=7, siginfo=0x7fe6e56d0770, ucxt=0x7fe6e56d0640, xsp=0x7fe6e56d0638 ";\016\071\351\346\177") at /home/bruening/dr/git/src/core/unix/signal.c:5107

0x00007fe6e93d1c59 <+1004>: lea 0x161388(%rip),%rax # 0x7fe6e9532fe8
0x00007fe6e93d1c60 <+1011>: mov (%rax),%rax
0x00007fe6e93d1c63 <+1014>: test %rax,%rax
0x00007fe6e93d1c66 <+1017>: je 0x7fe6e93d1ccc
0x00007fe6e93d1c68 <+1019>: lea 0x161379(%rip),%rax # 0x7fe6e9532fe8
0x00007fe6e93d1c6f <+1026>: mov (%rax),%rax
==>
0x00007fe6e93d1c72 <+1029>: mov 0x218(%rax),%eax
0x00007fe6e93d1c78 <+1035>: test %eax,%eax
0x00007fe6e93d1c7a <+1037>: je 0x7fe6e93d1ccc
0x00007fe6e93d1c7c <+1039>: lea 0x161365(%rip),%rax # 0x7fe6e9532fe8
0x00007fe6e93d1c83 <+1046>: mov (%rax),%rax
0x00007fe6e93d1c86 <+1049>: mov 0x214(%rax),%eax
0x00007fe6e93d1c8c <+1055>: and $0x10,%eax
0x00007fe6e93d1c8f <+1058>: test %eax,%eax
0x00007fe6e93d1c91 <+1060>: je 0x7fe6e93d1ccc
0x00007fe6e93d1c93 <+1062>: callq 0x7fe6e93ae109

(gdb) p &((dr_statistics_t*)0)->loglevel
$2 = (uint *) 0x218
(gdb) p d_r_stats
$3 = (dr_statistics_t *) 0x0
```

Must be a race where d_r_stats is set to NULL in between the check for NULL and
the de-ref of loglevel.

I was not planning to fix it: b/c it would require eliminating all LOG calls on detach paths, which are useful for debugging, and b/c it is limited to debug build.

Contributor guide

Open the contributing guide

Research direction

Start with src/core/unix/signal.c around master_signal_handler_C and the d_r_stats access shown in the trace. Reproduce the crash using the debug build and suite/tests/api/detach_signal.cpp, especially handle_signal at line 105. Done means the detach race no longer causes the signal handler to crash while preserving useful debug-path logging.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.