Date: Mon, 24 May 2021 13:09:21 +0300 From: Alexey Izbyshev <izbyshev@...ras.ru> To: musl@...ts.openwall.com Subject: Potentially infinite loop in posix_spawn'ed child Hi, I've noticed the following loop at https://git.musl-libc.org/cgit/musl/tree/src/process/posix_spawn.c#n159: exec(args->path, args->argv, args->envp); ret = -errno; fail: /* Since sizeof errno < PIPE_BUF, the write is atomic. */ ret = -ret; if (ret) while (__syscall(SYS_write, p, &ret, sizeof ret) < 0); _exit(127); Is there any reason that write is done in a loop? If SIGPIPE is blocked or ignored and the parent dies before this point, the child will spin in it forever. A test case is attached. It overrides execve() to abuse it as a callback, avoiding reliance on timings. As an aside, perhaps it would make sense to call execve() in posix_spawn() implementation via a hidden symbol? This would both make it consistent with posix_spawnp() and avoid any trouble with user code executing in a vfork'ed child if execve() is overridden via e.g. LD_PRELOAD. Alexey View attachment "test.c" of type "text/x-c" (440 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.