QuarkContainer / Quark

A secure container runtime with CRI/OCI interface
Apache License 2.0
318 stars 47 forks source link

aarch64: vvar or vdso being modified after executing a command. #1305

Closed CharlyYu closed 1 month ago

CharlyYu commented 4 months ago

I found everytime when I execute bash of ubuntu by docker exec -ti --runtime=quark_d ubuntu /bin/bash, The quark will crash because of a pagefault of a same address with a same pc address pointing to the vdso. so I made this test codes and it also reproduce the issue.

#include <stdio.h>
#include <unistd.h>
#include <sys/time.h>
int main()
{
    system("ls -al");
    struct timeval val;
    int ret = gettimeofday(&val, NULL);
    if (ret == -1)
    {
        printf("Error: gettimeofday()\n");
        return ret;
    }

    printf("sec: %ld, usec: %ld\n", val.tv_sec, val.tv_usec);

    return 0;
}

I think maybe it is because after we executed a command, the vdso or vvar memories are modified.

CharlyYu commented 3 months ago

It turns out that the signal handler set rt_sigreturn address to a wrong address after the vdso being updated.

shrik3 commented 3 months ago

It turns out that the signal handler set rt_sigreturn address to a wrong address after the vdso being updated.

sorry for late reply. The vdso sigreturn symbol has a different offset which caused issue. I thought I reported this earlier somewhere (https://github.com/QuarkContainer/Quark/pull/1248 which is replaced by #1292 ) my bad not putting it in an issue.

Because of the offset difference, sigreturn call becomes get time or something.

CharlyYu commented 3 months ago

Because of the offset difference, sigreturn call becomes get time or something.

Yes, I didn't notice that #1292 is working on this, I thought it is just a refactor of codes.

chl337 commented 3 months ago

@CharlyYu does #1292 works for you?

shrik3 commented 1 month ago

should have been fixed, please reopen if necessary.