Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 May 2021 13:09:21 +0300
From: Alexey Izbyshev <>
Subject: Potentially infinite loop in posix_spawn'ed child


I've noticed the following loop at

     exec(args->path, args->argv, args->envp);
     ret = -errno;

     /* Since sizeof errno < PIPE_BUF, the write is atomic. */
     ret = -ret;
     if (ret) while (__syscall(SYS_write, p, &ret, sizeof ret) < 0);

Is there any reason that write is done in a loop? If SIGPIPE is blocked 
or ignored and the parent dies before this point, the child will spin in 
it forever.

A test case is attached. It overrides execve() to abuse it as a 
callback, avoiding reliance on timings.

As an aside, perhaps it would make sense to call execve() in 
posix_spawn() implementation via a hidden symbol? This would both make 
it consistent with posix_spawnp() and avoid any trouble with user code 
executing in a vfork'ed child if execve() is overridden via e.g. 

View attachment "test.c" of type "text/x-c" (440 bytes)

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.