[Bug gdb/26754] Race condition when resuming threads and one does an exec

["simark at simark dot ca" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=26754

--- Comment #5 from Simon Marchi <simark at simark dot ca> ---
Just a precision about this:

> I think that we would need a new event, similar to PTRACE_EVENT_EXEC but
> that is reported after all threads in the process are exited (and report
> their exit) and _before_ the tid of the execing thread is changed.  Let's
> call it PTRACE_EVENT_ALMOST_EXEC.  At this point, like with
> PTRACE_EVENT_EXEC (before other threads are reaped), the previous leader
> would be in zombie state.  The process had already loaded the new address
> space when PTRACE_EVENT_ALMOST_EXEC is reported.  So if GDB happens to try
> to resume the leader just while some other thread execs, it would fail to
> ptrace-resume it with ESRCH because it was zombie.  GDB would react to
> PTRACE_EVENT_ALMOST_EXEC like it reacts to PTRACE_EVENT_EXEC -- by loading
> the new symbols, and installing breakpoints in the new address space. 
> Except it wouldn't destroy the non-leader thread yet -- that would happen on
> PTRACE_EVENT_EXEC.

If we look at fs/exec.c in the kernel, around function "de_thread":

https://github.com/torvalds/linux/blob/3494d58865ad4a47611dbb427b214cc5227fa5eb/fs/exec.c

It looks like other threads are deleted first, and the new address space is set
up second.  What you describes implies that it's the other way around.

The way I see it could work is like this.  Let's say the leader is 100.100 and
the non-leader is 100.101.

1. non-leader execs
2. all other threads are removed
3. PTRACE_EVENT_ALMOST_EXEC is fired: GDB deletes other threads from its data
structures
4. GDB resumes execution of 100.101
5. kernel renames 100.101 into 100.100 and sets up new address space
6. PTRACE_EVENT_EXEC is fired: GDB updates the ptid from 100.101 to 100.100 in
its data structures, loads the new symbols
7. GDB resumes execution of 100.100

-- 
You are receiving this mail because:
You are on the CC list for the bug.