Question

I am using ptrace to trace a child process. It works perfectly well when the child process exit normally. But if it exit abnormally, the program get into an infinite loop in-spite of using the macro WIFSIGNALED(&status). Here is sample child process:

try.c

int main()
   {
      int a=5/0;
   }

And here is tracing program

#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/user.h>
#include <sys/syscall.h>   /* For SYS_write etc */
#include <sys/reg.h>
#include <signal.h>
int main()
{   
    pid_t child;
    long orig_eax, eax;
    int status,insyscall = 0;
    child = fork();
    if(child == 0)
    {
            ptrace(PTRACE_TRACEME, 0, NULL, NULL);
            execl("./try", "try", NULL);
    }
    else
    {
        siginfo_t sig;
        memset(&sig,0,sizeof(siginfo_t));
        while(1)
        {
            wait(&status);
            if(WIFSIGNALED(status))
            {
                printf("Exiting due to signal\n");
                exit(0);
            }
            if(WIFEXITED(status))
                break;
            orig_eax = ptrace(PTRACE_PEEKUSER,child, 4 * ORIG_EAX, NULL);
            printf("system call number=%ld\n",orig_eax);
            if(insyscall == 0)
            {
                      /* Syscall entry */
                      insyscall = 1;
                      printf("In sys call\n");
            }
            else 
            {
               /* Syscall exit */
                 eax = ptrace(PTRACE_PEEKUSER,child, 4 * EAX, NULL);
                 printf("System call returned with %ld\n", eax);
                 insyscall = 0;
             }
            ptrace(PTRACE_SYSCALL,child, NULL, NULL);
        }
    }
    return 0;
}

Why the signal is not being detected which otherwise works when ptrace is not used?

Answer 1

When you ptrace a process, wait will return for any state change. One of those is when the process is about to receive a signal. Your wait will return before the signal is delivered to the child. You need to use PTRACE_CONT to allow the signal to be delivered to the child, if that’s what you want to happen.

Why does it work this way? Well remember, ptrace’s main purpose is to be used in implementing debuggers. If you didn’t get a chance to intercept signals such as SIGSEGV, the debugger couldn’t stop and let you examine the seg fault before the process was torn down.