[9front] exec suicide: sys: bad address in syscall

[9front] exec suicide: sys: bad address in syscall

[istvan bak]

Hello. The below program suicides on a call to fork/exec. If I made
the mistake, then I can't see it. If I didn't, then I don't know how
to debug the kernel(?), and I don't have time to stare at it for days
on end :/.

If I remove the Waitmsg, it doesn't repro. If I remove the print(""),
it doesn't repro. if i inline the body, it doesn't repro. something
something callstack mumble address syscall mumble. It repros on amd64,
but not 386.

http://sysinfo.9front.org/src/460/body

term% mk 6.red
6c -FTVw red.c
6l  -o 6.red red.6
term% 6.red
term% 6.red 666: suicide: invalid address 0x7fff00000000/1 in sys call
pc=0x200216
6.red 666: suicide: sys: bad address in syscall pc=0x200216
6.red 667: suicide: invalid address 0x7fff00000000/1 in sys call pc=0x200216
6.red 667: suicide: sys: bad address in syscall pc=0x200216

term% acid 666
/proc/666/text:amd64 plan 9 executable
/sys/lib/acid/port
/sys/lib/acid/amd64
acid: lstk()
exec(a0=0x4009a0)+0xe /sys/src/libc/9syscall/exec.s:6
execl(f=0x4009a8)+0x13 /sys/src/libc/port/execl.c:8
rc(cmd=0x4009c1)+0x4f /usr/glenda/riv/nag/red.c:17
run()+0x19 /usr/glenda/riv/nag/red.c:29
	i=0x20014500000001
main()+0x9 /usr/glenda/riv/nag/red.c:69
_main+0x40 /sys/src/libc/amd64/main9.s:15
acid:
echo kill > /proc/666/ctl
term% cat red.c
#include <u.h>
#include <libc.h>

int
rc(char *cmd)
{
	int r;
	Waitmsg *w;

	SET(w); USED(w);
	r = fork();
	switch(r){
	case -1:
		return -1;
	case 0:
		execl("/bin/rc", "/bin/rc", "-c", cmd, 0);
		sysfatal("exec returned");
	}
	return 0;
}

void
run(void)
{
	int i;

	for(i = 0; i < 3; i++){
		rc("test");
		print("");
	}
}

void
run2(void)
{
	int i;
	int r;
	Waitmsg *w;

	SET(w); USED(w);
	for(i = 0; i < 3; i++){
		r = fork();
		switch(r){
		case -1:
			continue;
		case 0:
			execl("/bin/rc", "/bin/rc", "-c", "test", 0);
			sysfatal("exec returned");
		}
		print("");
	}
}

void
main()
{
	//to test: uncomment one of the below lines
	//reproduces on amd64, but not on 386


	// this reproduces
	run();


	// this doesnt
	//run2();


	exits(0);
}

Re: [9front] exec suicide: sys: bad address in syscall

[ori]

Quoth istvan bak <bdhpfl@gmail.com>:
> 			execl("/bin/rc", "/bin/rc", "-c", "test", 0);

0 is an int, not a pointer. You're leaving half of the
pointer value uninitialized.

use nil.

Re: [9front] exec suicide: sys: bad address in syscall

[Amavect]

On Sun, 8 May 2022 17:38:27 +0000
istvan bak <bdhpfl@gmail.com> wrote:

> term% 6.red 666: suicide: invalid address 0x7fff00000000/1 in sys call

> 		execl("/bin/rc", "/bin/rc", "-c", cmd, 0);

You have been bitten by varargs.

The 4 bytes of 0x7fff00000000 is 32 bits.
That 0 is a 32-bit integer.
The 0 is not being converted due to varargs.
Casting to (char*) or (void*) fixes your issue.

See the warning when compiling this:
print("%p", 0);
warning: red.c:17 format mismatch p INT, arg 2
This is a problem in every C implementation.
Varargs suck.

For fun, the disassembly:
without casting (MOVL moves a 32 bit value):
rc+0x42 0x000000000020006a	MOVL	$0x0,0x20(SP)
rc+0x4a 0x0000000000200072	CALL	execl(SB)

with casting (MOVQ moves a 64 bit value):
rc+0x42 0x000000000020006a	MOVQ	$0x0,0x20(SP)
rc+0x4b 0x0000000000200073	CALL	execl(SB)

Note that run2() doesn't cast, either.
You got lucky that the higher 32 bits are zero.

Thanks,
Amavect

Re: [9front] exec suicide: sys: bad address in syscall

[istvan bak]

thank you for both answers. i should have figured this out on my own.
sorry for the noise.

On 08/05/2022, Amavect <amavect@gmail.com> wrote:
> On Sun, 8 May 2022 17:38:27 +0000
> istvan bak <bdhpfl@gmail.com> wrote:
>
>> term% 6.red 666: suicide: invalid address 0x7fff00000000/1 in sys call
>
>> 		execl("/bin/rc", "/bin/rc", "-c", cmd, 0);
>
> You have been bitten by varargs.
>
> The 4 bytes of 0x7fff00000000 is 32 bits.
> That 0 is a 32-bit integer.
> The 0 is not being converted due to varargs.
> Casting to (char*) or (void*) fixes your issue.
>
> See the warning when compiling this:
> print("%p", 0);
> warning: red.c:17 format mismatch p INT, arg 2
> This is a problem in every C implementation.
> Varargs suck.
>
> For fun, the disassembly:
> without casting (MOVL moves a 32 bit value):
> rc+0x42 0x000000000020006a	MOVL	$0x0,0x20(SP)
> rc+0x4a 0x0000000000200072	CALL	execl(SB)
>
> with casting (MOVQ moves a 64 bit value):
> rc+0x42 0x000000000020006a	MOVQ	$0x0,0x20(SP)
> rc+0x4b 0x0000000000200073	CALL	execl(SB)
>
> Note that run2() doesn't cast, either.
> You got lucky that the higher 32 bits are zero.
>
> Thanks,
> Amavect
>