DynamoRIO / DynamoRIO/dynamorio

HANG while running gcc with sample cbr: synchall fails to handle vfork properly

Open
#6,853 6 comments 0 reactions 0 assignees View on GitHub
Bug-Hang help wanted OpSys-UNIX
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

**Describe the bug**
When running `gcc hello.c -o hello` with the client `cbr`, dynamorio hangs. This was observed for both x86 and RISCV64.

However, when we do not use `dr_flush_region()` and `dr_redirect_execution()` in [cbr.c](https://github.com/DynamoRIO/dynamorio/blob/304faf96845b06b4889e1c2ce1b49c3ba9b22462/api/samples/cbr.c#L265), everything is OK! As we have inserted the `jmp` instruction after clean call, cbr still works correctly without `dr_flush_region()` and `dr_redirect_execution()` (with performance loss perhaps).

So, dr_redirect_execution() may involves some bugs. As we invoke `prepare_for_call_ex()` and other 'save' operations before clean call, I'm not sure it's right not to call `cleanup_after_call_ex()` to restore when using the dr_redirect_execution() routine.

X86 output log is:

```
$ ./bin64/drrun -c api/bin/libcbr.so -- gcc ../scripts/test_clients/hello.c -o ../scripts/test_clients/hello_x86

...... (repeating)
```

**Expected behavior**
DO NOT use dr_redirect_execution() in cbr, we can run the program successfully:

```
$ ./bin64/drrun -c api/bin/libcbr.so -- gcc ../scripts/test_clients/hello.c -o ../scripts/test_clients/hello_x86

<-- execve /usr/lib/gcc/x86_64-linux-gnu/9/cc1 -->

<(1+x) Handling our fault in a TRY at 0x00007fecc87f4d4e>

<-- execve /home/chy/.local/bin/as -->
<-- execve /usr/local/sbin/as -->
<-- execve /usr/local/bin/as -->
<-- execve /usr/sbin/as -->
<-- execve /usr/bin/as -->

<(1+x) Handling our fault in a TRY at 0x00007f2064b7ed4e>

<-- execve /usr/lib/gcc/x86_64-linux-gnu/9/collect2 -->

<-- execve /usr/bin/ld -->

<(1+x) Handling our fault in a TRY at 0x00007f0309de9d4e>

```

**Other information**

- Without any clients, everything is OK.
- Under my test, some simple applications (such as `hello_world.c`, `ls` and so on) can run correctly.
- cbr sample has not been ported to AARCH64 formally, but I have tried it and found that it still faces the same problem of dr_redirect_execution().

Contributor guide

Open the contributing guide

Research direction

Start at api/samples/cbr.c around the dr_flush_region() and dr_redirect_execution() calls near line 265, then reproduce the hang with cbr running gcc hello.c -o hello. Compare this with the variant that omits those calls and inspect the synchall/vfork handling involved. Done means gcc completes without hanging on the reported x86 and RISCV64 cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.