1176456 - Incorrect restore of ARM_ip in syscall_trace()

Status: RESOLVED FIXED

(Firefox OS Graveyard :: GonkIntegration, defect)

Description

[Julian Hector [:tedd] [:jhector]]

When a process is traced and resumed with ptrace(PTRACE_SYSCALL,...), the tracee process will crash with a segmentation fault because the instruction pointer is set to zero.

This is due to a bug inside the arm implementation of the syscall_trace function of the kernel. It is not present in the mainstream kernel, it was introduced during a backport (e.g. Linux 3.4 for nexus-5[1])

This bug prevents strace from working correctly and might affect other functionality that uses the syscall_trace function.

The fix is fairly simple, but multiple branches inside the forked[2] repository of the msm repo from codeaurora[3] and msm repo itself is affected. I will create pull requests to fix this issue as soon as I can.

[1] https://github.com/mozilla-b2g/codeaurora_kernel_msm/commit/475fc662ece6570851f3f3a3879145a0a7159a54
[2] https://github.com/mozilla-b2g/codeaurora_kernel_msm
[3] git://codeaurora.org/kernel/msm.git

Comment 1

[Julian Hector [:tedd] [:jhector]]

Attachment: PR codeaurora_kernel_msm - b2g-msm-hammerhead-3.4-lollipop-release branch

Comment 2

[Julian Hector [:tedd] [:jhector]]

Attachment: PR codeaurora_kernel_msm - b2g-msm-hammerhead-3.4-lollipop-mr1 branch

Comment 3

[Julian Hector [:tedd] [:jhector]]

Attachment: PR codeaurora_kernel_msm - b2g-msm-hammerhead-3.4-kitkat-mr1 branch

Comment 4

[Julian Hector [:tedd] [:jhector]]

Attachment: PR codeaurora_kernel_msm - t2m-flame-3.4-jb branch

Comment 5

[Julian Hector [:tedd] [:jhector]]

Attachment: PR codeaurora_kernel_msm - t2m-flame-3.4-kk branch

Comment 6

[Julian Hector [:tedd] [:jhector]]

Attachment: PR codeaurora_kernel_msm - foxfone-one-lollipop branch

Comment 7

[Kai-Zhen Li [:seinlin][:kli]]

Comment on attachment 8625073 [details] [review]
PR codeaurora_kernel_msm - b2g-msm-hammerhead-3.4-lollipop-release branch

Good catch. Thanks!

Comment 8

[Kai-Zhen Li [:seinlin][:kli]]

Some devices use prebuilt kernel, such as Nexux 5 [1], the prebuilt one need to be updated accordingly. 

[1] https://github.com/mozilla-b2g/device_lge_hammerhead-kernel/commit/8141110f671de1c399ab11d3f37a967c31930ac8

Comment 9

[Julian Hector [:tedd] [:jhector]]

Attachment: PR device_lge_hammerhead-kernel - b2g-4.4.2_r1 branch

precompiled hammerhead kernel that includes fix from b2g-msm-hammerhead-3.4-kitkat-mr1 branch

Comment 10

[Julian Hector [:tedd] [:jhector]]

Attachment: PR device_lge_hammerhead-kernel - b2g-5.0.0_r6 branch

precompiled hammerhead kernel that includes fix from b2g-msm-hammerhead-3.4-lollipop-release branch

Comment 11

[Julian Hector [:tedd] [:jhector]]

Attachment: PR device_lge_hammerhead-kernel - b2g-5.1.0_r1 branch

precompiled hammerhead kernel that includes fix from b2g-msm-hammerhead-3.4-lollipop-mr1 branch

Comment 12

[Julian Hector [:tedd] [:jhector]]

(In reply to Kai-Zhen Li [:kli][:seinlin] from comment #8)
> Some devices use prebuilt kernel, such as Nexux 5 [1], the prebuilt one need
> to be updated accordingly. 
> 
> [1]
> https://github.com/mozilla-b2g/device_lge_hammerhead-kernel/commit/
> 8141110f671de1c399ab11d3f37a967c31930ac8

I created some pull requests with an updated kernel image that was compiled with the fix from the other pull requests.

Comment 13

[Julian Hector [:tedd] [:jhector]]

hi diego, how can I upstream this fix to codeaurora?

As far as I can tell it doesn't have a direct impact on regular users, but it would allow developers to use strace on devices that are affected.

Comment 14

[Kai-Zhen Li [:seinlin][:kli]]

Comment on attachment 8627447 [details] [review]
PR device_lge_hammerhead-kernel - b2g-5.1.0_r1 branch

Thanks for the update.

Comment 15

[Julian Hector [:tedd] [:jhector]]

hey :kang, :jld can you give it a review please so that the patches can be merged?

I don't know if it makes sense for a review on a pre-built kernel, but if someone else should rather rebuild them with the gives changes, just mark them as obsolete.

Comment 16

[Guillaume Destuynder [:kang] [this account is no longer active]]

Comment on attachment 8627445 [details] [review]
PR device_lge_hammerhead-kernel - b2g-4.4.2_r1 branch

Cant reproduce/verify binary easily but otherwise looks good

Comment 17

[Guillaume Destuynder [:kang] [this account is no longer active]]

Comment on attachment 8627446 [details] [review]
PR device_lge_hammerhead-kernel - b2g-5.0.0_r6 branch

same comment as previous attachment (binary)

Comment 18

[Guillaume Destuynder [:kang] [this account is no longer active]]

Comment on attachment 8627447 [details] [review]
PR device_lge_hammerhead-kernel - b2g-5.1.0_r1 branch

same comment as previous attachment (binary)

Comment 19

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8627445 [details] [review]
PR device_lge_hammerhead-kernel - b2g-4.4.2_r1 branch

I also haven't tried to inspect the binaries, but the commit looks good otherwise.

Comment 20

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8627446 [details] [review]
PR device_lge_hammerhead-kernel - b2g-5.0.0_r6 branch

(See above.)

Comment 21

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

Comment on attachment 8627447 [details] [review]
PR device_lge_hammerhead-kernel - b2g-5.1.0_r1 branch

(See above.)

Comment 22

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

https://github.com/mozilla-b2g/codeaurora_kernel_msm/commit/68cd180df4a744540f69470d8084d57d15af3968
https://github.com/mozilla-b2g/codeaurora_kernel_msm/commit/00797cece6e798c34238e4a09e89ad56262fffed
https://github.com/mozilla-b2g/codeaurora_kernel_msm/commit/aa3382be96f47c6e15515e220ad90a287635f0f4
https://github.com/mozilla-b2g/codeaurora_kernel_msm/commit/bfe6f81baf569313570dd03b866b7783d4b0e128
https://github.com/mozilla-b2g/codeaurora_kernel_msm/commit/47aac20dbffea5874cbbbdc6556558855c38dce4
https://github.com/mozilla-b2g/codeaurora_kernel_msm/commit/a0ba1af24717a2b594656bb83e1fbdd7964662fb
https://github.com/mozilla-b2g/device_lge_hammerhead-kernel/commit/1852cd4b89f941eae7a893800ce1806b96b343fc
https://github.com/mozilla-b2g/device_lge_hammerhead-kernel/commit/9b26e183391876df9b5fcde018a3021e6bee8765
https://github.com/mozilla-b2g/device_lge_hammerhead-kernel/commit/8b3ffcfdd3d3852eca5488628f8bb2a08acbffa7

Comment 23

[Julian Hector [:tedd] [:jhector]]

clearing the needinfo