Bug 15273

Summary: Regression in ptrace (Wine) starting with 2.6.33-rc1
Product: Process Management Reporter: Michael Stefaniuc (mstefani)
Component: OtherAssignee: process_other
Status: CLOSED CODE_FIX    
Severity: high CC: maciej.rutecki, rjw, saulius2
Priority: P1    
Hardware: All   
OS: Linux   
URL: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=72f674d203cd230426437cdcf7dd6f681dad8b0d
Kernel Version: 2.6.33-rc Subsystem:
Regression: Yes Bisected commit-id:
Bug Depends on:    
Bug Blocks: 14885    

Description Michael Stefaniuc 2010-02-11 16:21:07 UTC
2.6.33-rc1 broke ptrace for Wine, specifically the setting of the debug registers. This is visible in the Wine ntdll exception tests failing on 2.6.33-rcX while they work just fine in 2.6.32.

A regression test resulted in:
72f674d203cd230426437cdcf7dd6f681dad8b0d is the first bad commit
commit 72f674d203cd230426437cdcf7dd6f681dad8b0d
Author: K.Prasad <prasad@linux.vnet.ibm.com>
Date:   Mon Jun 1 23:45:48 2009 +0530

    hw-breakpoints: modify Ptrace routines to access breakpoint registers

    This patch modifies the ptrace code to use the new wrapper routines around the
    debug/breakpoint registers.

    [ Impact: adapt x86 ptrace to the new breakpoint Api ]

    Original-patch-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: K.Prasad <prasad@linux.vnet.ibm.com>
    Signed-off-by: Maneesh Soni <maneesh@linux.vnet.ibm.com>
    Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>

:040000 040000 f72ff4760c3fa1dffcd72494e77bee2c76039505 b60d5fe2088ff635568e800d5759a0b373b5e439 M      arch


The first ntdll exception test in test_exceptions() http://source.winehq.org/git/wine.git/?a=blob;f=dlls/ntdll/tests/exception.c;h=9149b6961764dec31a0af5cd3b93ab3072703dbb;hb=312e4f6b235a468f8bf764101a5b97cf34dd4143#l594
  run_exception_test(dreg_handler, NULL, &segfault_code, sizeof(segfault_code), 0);
produces (make exception.ok) the output:
  err:seh:setup_exception_record stack overflow 932 bytes in thread 0009 eip 7bc3c97f esp 00240f8c stack 0x240000-0x241000-0x340000
The stack overflow is detected by the ntdll internal function setup_exception_record() http://source.winehq.org/git/wine.git/?a=blob;f=dlls/ntdll/signal_i386.c;h=4eccb61954c43d75144575411313d59405decfc3;hb=312e4f6b235a468f8bf764101a5b97cf34dd4143#l1495 which aborts the thread.
The problem happens on both i386 (Intel Atom CPU) as well as on x86_64 (Intel Q9450); the stack overflow bytes differ though but are always the same for each box.

All the ntdll exception tests run just fine with 2.6.32 and older kernels. For a summary of the ntdll exception tests please see http://test.winehq.org/data/tests/ntdll:exception.html in the Wine column.

thanks
bye
    michael
Comment 1 Michael Stefaniuc 2010-02-11 20:43:11 UTC
On 02/11/2010 07:22 PM, Frederic Weisbecker wrote: 
> Thanks a lot for your report. Is there an easy way to reproduce
> this?
Yes, the bug is 100% reproducible. Even the "stack overflow" bytes are
always constant on my two boxes: 932 bytes on my Atom and 1588 bytes on
my Q9450 with a x86_64 kernel.

Either grab wine-1.1.38 from
http://sourceforge.net/projects/wine/files/Source/ or from git
  git clone git://source.winehq.org/git/wine.git
configure
make
cd dlls/ntdll/tests/
make exception.ok

If you build on an x86_64 machine you'll need a pretty complete 32bit
setup too, but configure will let you know. If configure doesn't errors
out but produces warnings, those can be safely ignored. It means the
dependencies are optional and those aren't needed to reproduce this bug.

Oh, there might be an other regression in ptrace too; introduced by a
previous patch in this series. While bisecting i had a later test fail,
something along the lines of "expected 4 exceptions got 0", but the
tests completed. Now the stack corruption mask everything else in the
tests; e.g. comment out the first test and one of the next tests will go
into an infinite loop printing 3 Wine errors over and over again.
Comment 2 Michael Stefaniuc 2010-02-13 21:45:46 UTC
On 02/13/2010 06:33 PM, K.Prasad wrote:
> Can you be more specific with details - such as what was the desired
> action/return value of ptrace that your testcase wanted but did not
> happen (after the patch applied)? What is the other regression that
> you found as a result of another patch in the hw-breakpoint patch
> series?
>
> I am able to see a user-space stackdump upon a 'make exception.ok',
> which isn't easy enough (atleast for me) to narrow down to the purported
> ptrace defect.
Here is a discussion I had with the Wine maintainer on what that
specific test does exactly:
<julliard> puk: the test changes the debug regs in the context, which makes the server use ptrace to change the debug regs in the test process
<puk> cool
<puk> so i basically just do an strace on the server
<julliard> then it does a GetContext to verify that they have been set correctly
<julliard> yes all the ptrace calls are in the server
<puk> and capture what ptrace returns
<puk> let me guess GetContext uses ptrace too?
<julliard> yes
<julliard> if it even gets to that point, it sounded like it was crashing inside the exception handler

The wineserver is basically the "kernel space" in Wine.

Test setup:
-----------
# Start the wineserver and and attach to it
wineserver
strace -p $wineserver_pid >& strace.out
# Run the test
cd dlls/ntdll/tests/
make exception.ok

Results 2.6.33-rcX:
-------------------
ptrace(PTRACE_ATTACH, 18036, 0, 0)      = 0
ptrace(PTRACE_POKEUSER, 18036, offsetof(struct user, u_debugreg), 0x42424242) = 0
ptrace(PTRACE_POKEUSER, 18036, offsetof(struct user, u_debugreg) + 4, 0) = 0
ptrace(PTRACE_POKEUSER, 18036, offsetof(struct user, u_debugreg) + 8, 0) = 0
ptrace(PTRACE_POKEUSER, 18036, offsetof(struct user, u_debugreg) + 12, 0) = 0
ptrace(PTRACE_POKEUSER, 18036, offsetof(struct user, u_debugreg) + 24, 0) = 0
ptrace(PTRACE_POKEUSER, 18036, offsetof(struct user, u_debugreg) + 28, 0x155) = -1 EINVAL (Invalid argument)

Results 2.6.32:
---------------
trace(PTRACE_ATTACH, 3077, 0, 0)       = 0
ptrace(PTRACE_POKEUSER, 3077, offsetof(struct user, u_debugreg), 0x42424242) = 0
ptrace(PTRACE_POKEUSER, 3077, offsetof(struct user, u_debugreg) + 4, 0) = 0
ptrace(PTRACE_POKEUSER, 3077, offsetof(struct user, u_debugreg) + 8, 0) = 0
ptrace(PTRACE_POKEUSER, 3077, offsetof(struct user, u_debugreg) + 12, 0) = 0
ptrace(PTRACE_POKEUSER, 3077, offsetof(struct user, u_debugreg) + 24, 0) = 0
ptrace(PTRACE_POKEUSER, 3077, offsetof(struct user, u_debugreg) + 28, 0x155) = 0

So it looks like something in the setting of DR7 is broken or at least
changed behavior. The function in Wine that does those calls is
set_thread_context() from server/ptrace.c.
Comment 3 Rafael J. Wysocki 2010-02-17 19:53:33 UTC
On Wednesday 17 February 2010, Frederic Weisbecker wrote:
> On Mon, Feb 15, 2010 at 12:38:35AM +0100, Rafael J. Wysocki wrote:
> > This message has been generated automatically as a part of a summary report
> > of recent regressions.
> > 
> > The following bug entry is on the current list of known regressions
> > from 2.6.32.  Please verify if it still should be listed and let the
> tracking team
> > know (either way).
> > 
> > 
> > Bug-Entry   : http://bugzilla.kernel.org/show_bug.cgi?id=15273
> > Subject             : Regression in ptrace (Wine) starting with 2.6.33-rc1
> > Submitter   : Michael Stefaniuc <mstefani@redhat.com>
> > Date                : 2010-02-11 16:21 (4 days old)
> 
> 
> We are taking care of it. It's actually two regressions.
> One has a fix that seems to work, and I'm working on the other one,
> trying to get that upstream before 2.6.33 gets released.
> 
> Please keep the ticket open for now.
Comment 4 Rafael J. Wysocki 2010-02-21 21:04:35 UTC
Handled-By : Frederic Weisbecker <fweisbec@gmail.com>
Patch : http://patchwork.kernel.org/patch/80783/
Patch : http://patchwork.kernel.org/patch/80785/