On Wed, Jun 30, 2010 at 2:22 PM, Sam Fourman Jr. <sfour...@gmail.com> wrote:
> On Wed, Jun 30, 2010 at 11:26 AM, Garrett Cooper <yanef...@gmail.com> wrote:
>> On Wed, Jun 30, 2010 at 8:43 AM, Sam Fourman Jr. <sfour...@gmail.com> wrote:
>>>> Which patch ? icebp generates the SIGTRAP on latest 8-stable, verified
>>>> by the following trivival assembler program:
>>>> .text
>>>> .globl main
>>>> main:
>>>> .byte 0xf1
>>>> xorl %edi,%edi
>>>> call exit
>>>>
>>>
>
> Here is the C program that the linux people used as a test case.
>
> ***************************************************************
> #include <stdio.h>
> #include <signal.h>
>
>
>
> void trap_handler(int sig)
> {
> printf("trapped\n");
> }
>
>
> /*
> * icebp
> * ret
> */
> char icebp_func[] = "\xf1\xc3";
> typedef void (*icebp_call)(void);
>
> int main(int argc, char **argv)
> {
> icebp_call func = (icebp_call)icebp_func;
>
> signal(SIGTRAP, trap_handler);
>
> func();
>
> return 0;
> }
>
> ***************************************************************
>
> My question is why doe the above code not print trapped on amd64?
>
> FreeBSD 8.1 i386 this code prints "Trapped" as intended
> FreeBSD 8.1 amd64 this code prints "Segmentation fault: 11"
> FreeBSD 8.1 amd64 chrooted to 32bit prints "Segmentation fault"
>
> I did verify that from Linux amd64 this works and prints "Trapped"
> uname -a
> Linux workstation 2.6.32-23-generic #37-Ubuntu SMP Fri Jun 11 08:03:28
> UTC 2010 x86_64 GNU/Linux
Hmmm... I've seen similar whackiness with Linux and signals, but
that's a different thing entirely (it was rt signals vs non-rt
signals).
Here's a modified version of the testcase (wanted to make sure that
things were sane):
$ cat test_sigtrap.c
#include <err.h>
#include <signal.h>
#include <stdio.h>
int trapped = 0;
void trap_handler(int sig)
{
trapped = 1;
}
/*
* icebp
* ret
*/
char icebp_func[] = "\xf1\xc3";
typedef void (*icebp_call)(void);
int main(int argc, char **argv)
{
icebp_call func = (icebp_call)icebp_func;
if (signal(SIGTRAP, trap_handler) == SIG_ERR)
err(1, "signal");
func();
if (trapped)
printf("Admiral Ackbar: it's a trap!\n");
return 0;
}
Ran it and it segfaulted on CURRENT:
$ sudo truss ./test_sigtrap
__sysctl(0x7fffffffe590,0x2,0x7fffffffe5ac,0x7fffffffe5a0,0x0,0x0) = 0 (0x0)
mmap(0x0,672,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34365169664 (0x80052e000)
munmap(0x80052e000,672) = 0 (0x0)
__sysctl(0x7fffffffe600,0x2,0x800638848,0x7fffffffe5f8,0x0,0x0) = 0 (0x0)
mmap(0x0,32768,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANON,-1,0x0) =
34365169664 (0x80052e000)
issetugid(0x80052f015,0x8005294e4,0x800644f50,0x800644f20,0x5b31,0x0) = 0 (0x0)
open("/etc/libmap.conf",O_RDONLY,0666) ERR#2 'No such file or
directory'
open("/var/run/ld-elf.so.hints",O_RDONLY,057) = 2 (0x2)
read(2,"ehnt\^a\0\0\0...@\0\0\0}\0\0\0\0"...,128) = 128 (0x80)
lseek(2,0x80,SEEK_SET) = 128 (0x80)
read(2,"/lib:/usr/lib:/usr/lib/compat:/u"...,125) = 125 (0x7d)
close(2) = 0 (0x0)
access("/lib/libc.so.7",0) = 0 (0x0)
open("/lib/libc.so.7",O_RDONLY,030703440) = 2 (0x2)
fstat(2,{ mode=-r--r--r-- ,inode=353312,size=1192760,blksize=16384 }) = 0 (0x0)
pread(0x2,0x800637700,0x1000,0x0,0x101010101010101,0x8080808080808080)
= 4096 (0x1000)
mmap(0x0,2318336,PROT_NONE,MAP_PRIVATE|MAP_ANON|MAP_NOCORE,-1,0x0) =
34366312448 (0x800645000)
mmap(0x800645000,1028096,PROT_READ|PROT_EXEC,MAP_PRIVATE|MAP_FIXED|MAP_NOCORE,2,0x0)
= 34366312448 (0x800645000)
mmap(0x80083f000,135168,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_FIXED,2,0xfa000)
= 34368385024 (0x80083f000)
mprotect(0x800860000,110592,PROT_READ|PROT_WRITE) = 0 (0x0)
close(2) = 0 (0x0)
sysarch(0x81,0x7fffffffe680,0x800533088,0x0,0xffffffffffcea590,0x8080808080808080)
= 0 (0x0)
mmap(0x0,176,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34365202432 (0x800536000)
munmap(0x800536000,176) = 0 (0x0)
mmap(0x0,44064,PROT_READ|PROT_WRITE,MAP_ANON,-1,0x0) = 34365202432 (0x800536000)
munmap(0x800536000,44064) = 0 (0x0)
sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0)
= 0 (0x0)
sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0)
__sysctl(0x7fffffffe620,0x2,0x800866d20,0x7fffffffe618,0x0,0x0) = 0 (0x0)
sigprocmask(SIG_BLOCK,SIGHUP|SIGINT|SIGQUIT|SIGKILL|SIGPIPE|SIGALRM|SIGTERM|SIGURG|SIGSTOP|SIGTSTP|SIGCONT|SIGCHLD|SIGTTIN|SIGTTOU|SIGIO|SIGXCPU|SIGXFSZ|SIGVTALRM|SIGPROF|SIGWINCH|SIGINFO|SIGUSR1|SIGUSR2,0x0)
= 0 (0x0)
sigprocmask(SIG_SETMASK,0x0,0x0) = 0 (0x0)
sigaction(SIGTRAP,{ 0x4005f0 SA_RESTART ss_t },{ SIG_DFL 0x0 ss_t }) = 0 (0x0)
SIGNAL 11 (SIGSEGV)
process exit, rval = 0
Also, is there perhaps a sideeffect dealing with the size of a char on
FreeBSD vs Linux?
That's a pretty badass way to load assembler instructions on the stack :).
Thanks!
-Garrett
_______________________________________________
freebsd-hackers@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-hackers
To unsubscribe, send any mail to "freebsd-hackers-unsubscr...@freebsd.org"
