NDK vfork implementation:
push {r4, r7}
mov r7, #190 ; 0xbe
svc 0x00000000
pop {r4, r7}
movs r0, r0
bxpl lr
b 0x1475c
bionic C vfork implentation(KitKat):
ENTRY(vfork)
mov ip, r7
ldr r7, =__NR_vfork
swi #0
mov r7, ip
cmn r0, #(MAX_ERRNO + 1)
bxls lr
neg r0, r0
b __set_errno
END(vfork)
与KitKat的vfork实现比较，感觉问题出在 push {r4, r7}
不知道NDK下个版本是否会修改vfork的实现，这样很容易导致栈内存出问题。
临时解决方法：
my_vfork.S
/* autogenerated by gensyscalls.py */
#include <asm/unistd.h>
#include <linux/err.h>
#include <machine/asm.h>
ENTRY(my_vfork)
mov ip, r7
ldr r7, =__NR_vfork
swi #0
mov r7, ip
cmn r0, #(MAX_ERRNO + 1)
bxls lr
neg r0, r0
b my_set_errno
END(my_vfork)
---------------------------------------------------------------------------------------
test.c
int my_set_errno(int n)
{
errno = n;
return -1;
}
int test(char** argv)
{
int status;
#if 0
pid_t pid = vfork();
#else
pid_t pid = my_vfork();
#endif
if (pid <0)
{
fprintf(stderr, "vfork failed(%s)\n", strerror(errno));
return;
}
if (pid == 0)
{
execvp(argv[0], argv);
_exit(111);
}else {
pid = waitpid(0, &status, 0);
}
return 0;
}
==============================================================================================
使用 gdb 跟踪该缺陷
# gdb --args /data/local/tmp/vfork ls -l
Reading symbols from /data/local/tmp/vfork...done.
(gdb) b vfork
Breakpoint 1 at 0x9684: file bionic/libc/arch-arm/syscalls/vfork.S, line 13.
(gdb) set follow-fork-mode child
(gdb) display /4i $pc-8
(gdb) r
Starting program: /data/local/tmp/vfork ls -l
Breakpoint 1, vfork () at bionic/libc/arch-arm/syscalls/vfork.S:13
13 bionic/libc/arch-arm/syscalls/vfork.S: No such file or directory.
1: x/4i $pc-8
0x967c <_exit+28>: nop ; (mov r0, r0)
0x9680 <vfork>: push {r4, r7}
=> 0x9684 <vfork+4>: mov r7, #190 ; 0xbe
0x9688 <vfork+8>: svc 0x00000000
(gdb) info registers
r0 0xbeb2f8e4 3199400164
r1 0xbeb2faa8 3199400616
r2 0x0 0
r3 0xc 12
r4 0x3 3
r5 0xbeb2f970 3199400304
r6 0xbeb2f8ec 3199400172
r7 0xbeb2f8f8 3199400184
r8 0x0 0
r9 0x0 0
r10 0x0 0
r11 0xbeb2f95c 3199400284
r12 0x0 0
sp 0xbeb2f8c0 0xbeb2f8c0
lr 0x8165 33125
pc 0x9684 0x9684 <vfork+4>
cpsr 0x80000010 -2147483632
(gdb) x/4xw $sp
0xbeb2f8c0: 0x00000003 0xbeb2f8f8 0xbeb2f8e4 0xbeb2f8e4
(gdb) disassemble $pc
Dump of assembler code for function vfork:
0x00009680 <+0>: push {r4, r7}
=> 0x00009684 <+4>: mov r7, #190 ; 0xbe
0x00009688 <+8>: svc 0x00000000
0x0000968c <+12>: pop {r4, r7}
0x00009690 <+16>: movs r0, r0
0x00009694 <+20>: bxpl lr
0x00009698 <+24>: b 0x145c4
0x0000969c <+28>: nop ; (mov r0, r0)
End of assembler dump.
(gdb) b *0x968c
Breakpoint 2 at 0x968c: file bionic/libc/arch-arm/syscalls/vfork.S, line 15.
(gdb) b execvp
Breakpoint 3 at 0x9a98: file bionic/libc/unistd/exec.c, line 202.
(gdb) c
Continuing.
[New process 5934]
[Switching to process 5934]
Breakpoint 2, vfork () at bionic/libc/arch-arm/syscalls/vfork.S:15
15 in bionic/libc/arch-arm/syscalls/vfork.S
1: x/4i $pc-8
0x9684 <vfork+4>: mov r7, #190 ; 0xbe
0x9688 <vfork+8>: svc 0x00000000
=> 0x968c <vfork+12>: pop {r4, r7}
0x9690 <vfork+16>: movs r0, r0
(gdb) x/4xw $sp
0xbeb2f8c0: 0x00000003 0xbeb2f8f8 0xbeb2f8e4 0xbeb2f8e4
(gdb) ni
vfork () at bionic/libc/arch-arm/syscalls/vfork.S:16
16 in bionic/libc/arch-arm/syscalls/vfork.S
1: x/4i $pc-8
0x9688 <vfork+8>: svc 0x00000000
0x968c <vfork+12>: pop {r4, r7}
=> 0x9690 <vfork+16>: movs r0, r0
0x9694 <vfork+20>: bxpl lr
(gdb)
17 in bionic/libc/arch-arm/syscalls/vfork.S
1: x/4i $pc-8
0x968c <vfork+12>: pop {r4, r7}
0x9690 <vfork+16>: movs r0, r0
=> 0x9694 <vfork+20>: bxpl lr
0x9698 <vfork+24>: b 0x145c4
(gdb)
test (argv=0x1f78028) at jni/vfork.c:48
48 jni/vfork.c: No such file or directory.
1: x/4i $pc-8
0x815c <test>: push {r0, r1, r2, r3, r4, lr}
0x815e <test+2>: str r0, [sp, #4]
0x8160 <test+4>: blx 0x9680 <vfork>
=> 0x8164 <test+8>: cmp r0, #0
(gdb)
0x00008166 48 in jni/vfork.c
1: x/4i $pc-8
0x815e <test+2>: str r0, [sp, #4]
0x8160 <test+4>: blx 0x9680 <vfork>
0x8164 <test+8>: cmp r0, #0
=> 0x8166 <test+10>: bge.n 0x8186 <test+42>
(gdb)
53 in jni/vfork.c
1: x/4i $pc-8
0x817e <test+34>: adds r0, #168 ; 0xa8
0x8180 <test+36>: bl 0x9d10 <fprintf>
0x8184 <test+40>: b.n 0x81a6 <test+74>
=> 0x8186 <test+42>: cmp r0, #0
(gdb)
0x00008188 53 in jni/vfork.c
1: x/4i $pc-8
0x8180 <test+36>: bl 0x9d10 <fprintf>
0x8184 <test+40>: b.n 0x81a6 <test+74>
0x8186 <test+42>: cmp r0, #0
=> 0x8188 <test+44>: bne.n 0x819a <test+62>
(gdb)
55 in jni/vfork.c
1: x/4i $pc-8
0x8182 <test+38>: stc2l 0, cr14, [r6, #60] ; 0x3c
0x8186 <test+42>: cmp r0, #0
0x8188 <test+44>: bne.n 0x819a <test+62>
=> 0x818a <test+46>: ldr r3, [sp, #4]
(gdb)
0x0000818c 55 in jni/vfork.c
1: x/4i $pc-8
0x8184 <test+40>: b.n 0x81a6 <test+74>
0x8186 <test+42>: cmp r0, #0
0x8188 <test+44>: bne.n 0x819a <test+62>
0x818a <test+46>: ldr r3, [sp, #4]
(gdb)
0x0000818e 55 in jni/vfork.c
1: x/4i $pc-8
0x8186 <test+42>: cmp r0, #0
0x8188 <test+44>: bne.n 0x819a <test+62>
0x818a <test+46>: ldr r3, [sp, #4]
0x818c <test+48>: ldr r0, [r3, #0]
(gdb) c
Continuing.
Breakpoint 3, execvp (name=0x1f78028 "ls", argv=0xbeb2f8e4)
at bionic/libc/unistd/exec.c:202
202 bionic/libc/unistd/exec.c: No such file or directory.
1: x/4i $pc-8
0x9a90 <execvp>: push {r4, r5, r6, r7, lr}
0x9a92 <execvp+2>: ldr r5, [pc, #464] ; (0x9c64 <execvp+468>)
0x9a94 <execvp+4>: ldr r4, [pc, #464] ; (0x9c68 <execvp+472>)
0x9a96 <execvp+6>: add sp, r5
(gdb) info registers
r0 0x1f78028 32997416
r1 0xbeb2f8e4 3199400164
r2 0x0 0
r3 0xbeb2f8e4 3199400164
r4 0xffffff9c 4294967196
r5 0xffffefb4 4294963124
r6 0xbeb2f8ec 3199400172
r7 0xbeb2f8f8 3199400184
r8 0x0 0
r9 0x0 0
r10 0x0 0
r11 0xbeb2f95c 3199400284
r12 0x0 0
sp 0xbeb2e868 0xbeb2e868
lr 0x8195 33173
pc 0x9a98 0x9a98 <execvp+8>
cpsr 0x80000030 -2147483600
(gdb)
最终子进程
0x0000968c <+12>: pop {r4, r7}
sp 恢复，而父进程要等到子进程执行到execve才恢复执行，届时sp才能恢复，
而当子进程执行完vfork，执行进入execvp时，执行push指令压入几个寄存器，
0x9a90 <execvp>: push {r4, r5, r6, r7, lr}
导致父进程在vfork中压入sp的r4, r7被这里的r7,lr取代，最终子进程执行exeve后，父进程vfork从svc后继续执行
0x0000968c <+12>: pop {r4, r7}
弹出的r7已被修改为0x8195，导致后续栈帧被破坏，程序崩溃。
136
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
