DynamoRIO / DynamoRIO/dynamorio
With -attach_unmask_suspend_signal, signal mask is not preserved while tracing or after detach
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
## Summary
`-attach_unmask_suspend_signal` unblocks DynamoRIO’s suspend signal (`SIGILL` by default) without saving the original signal mask.
As a result, affected threads have the wrong mask while tracing. The wrong mask can also remain after detach.
## Root cause
The attach path [clears the suspend signal before takeover](https://github.com/DynamoRIO/dynamorio/blob/14472393fc1f49ee0b2046454aa49aec2e149ee4/core/dynamo.c#L2979-L2998).
[`ptrace_unmask_signal()`](https://github.com/DynamoRIO/dynamorio/blob/14472393fc1f49ee0b2046454aa49aec2e149ee4/core/unix/ptrace_lib.c#L205-L220) reads the thread's mask, removes the signal, and writes the mask back. The original blocked state is not saved.
Both takeover paths then use the changed mask:
- The normal signal path reads it from the [signal frame](https://github.com/DynamoRIO/dynamorio/blob/14472393fc1f49ee0b2046454aa49aec2e149ee4/core/unix/signal.c#L5608-L5620).
- The direct ptrace path [reads the current mask](https://github.com/DynamoRIO/dynamorio/blob/14472393fc1f49ee0b2046454aa49aec2e149ee4/core/unix/ptrace_attach.c#L409-L416).
Once the Dynamo Reels are attached, these threads would have the wrong mask. Also, detach [copies this wrong mask into the signal frame](https://github.com/DynamoRIO/dynamorio/blob/14472393fc1f49ee0b2046454aa49aec2e149ee4/core/unix/signal.c#L8637-L8640), and `sigreturn` restores it.
The existing api.sigill_blocked test does not catch this because it stops the blocked thread before detach.
## Expected behavior
DynamoRIO should preserve the application's original blocked-signal state and restore it after detach.
Contributor guide
Assessment
This issue has not been assessed yet.