[Bug tapsets/20075] New: target_set_pid() returns False when execve() syscall is successful

["mysecondaccountabc at gmail dot com" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=20075

            Bug ID: 20075
           Summary: target_set_pid() returns False when execve() syscall
                    is successful
           Product: systemtap
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: tapsets
          Assignee: systemtap at sourceware dot org
          Reporter: mysecondaccountabc at gmail dot com
  Target Milestone: ---

Created attachment 9250
  --> https://sourceware.org/bugzilla/attachment.cgi?id=9250&action=edit
Script to show the issue

When execve() is called and it returns without error, for some reason a call to
target_set_pid(pid()) in this context returns "False", wrongly indicating that
the pid doesn't descend from the target process. It causes that syscall be
discarded from the syscall trace.

I'm using a slightly modified version of "strace.stp" to show the issue, see
the attachment.

sudo stap my_strace.stp -w -c "sh -c /bin/ls" 

====
...

||OK_CALL 3||: target_set_pid(12701):1 target:12701
||OK_RETURN 3||: target_set_pid(12701):1 target:12701
Wed May 11 00:49:14 2016.822339 rt_sigprocmask(SIG_SETMASK, [EMPTY], 0x0, 8) =
0

||OK_CALL 3||: target_set_pid(12701):1 target:12701
||OK_RETURN 3||: target_set_pid(12701):1 target:12701
Wed May 11 00:49:14 2016.822364 execve("/usr/local/sbin/sh", ["sh", "-c",
"/bin/ls"], [/* 18 vars */]) = -2 (ENOENT)

...

||OK_CALL 3||: target_set_pid(12701):1 target:12701
||FILTERED_RETURN 2||: target_set_pid(12701):0
>>FILTERED_RETURN<<: sh[12701] execve("/bin/sh", ["sh", "-c", "/bin/ls"], [/* 18 vars */]) = 0

... 
====

As you can see above in the last three lines, when the successful execve is
called, the target_set_pid(pid()) call in the nd_syscall.*.return probe returns
False "target_set_pid(12701):0", causing the syscall to be dropped.

-- 
You are receiving this mail because:
You are the assignee for the bug.