[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 May 2021 13:09:21 +0300
From: Alexey Izbyshev <izbyshev@...ras.ru>
To: musl@...ts.openwall.com
Subject: Potentially infinite loop in posix_spawn'ed child
Hi,
I've noticed the following loop at
https://git.musl-libc.org/cgit/musl/tree/src/process/posix_spawn.c#n159:
exec(args->path, args->argv, args->envp);
ret = -errno;
fail:
/* Since sizeof errno < PIPE_BUF, the write is atomic. */
ret = -ret;
if (ret) while (__syscall(SYS_write, p, &ret, sizeof ret) < 0);
_exit(127);
Is there any reason that write is done in a loop? If SIGPIPE is blocked
or ignored and the parent dies before this point, the child will spin in
it forever.
A test case is attached. It overrides execve() to abuse it as a
callback, avoiding reliance on timings.
As an aside, perhaps it would make sense to call execve() in
posix_spawn() implementation via a hidden symbol? This would both make
it consistent with posix_spawnp() and avoid any trouble with user code
executing in a vfork'ed child if execve() is overridden via e.g.
LD_PRELOAD.
Alexey
View attachment "test.c" of type "text/x-c" (440 bytes)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
