linux clone issue

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

Hello
I'm trying to run a binary-only linux program under NetBSD 9.2.
From what I found, the binary was built on Ubuntu 16.04

The program dies at at specific point and it seems to be a bug in our
emulation:
 26751  26751 mylinuxprog CALL  close(3)
 26751  26751 mylinuxprog RET   close 0
 26751  26751 mylinuxprog CALL  wait4(0x558d,0x7f7fffffde10,0,0)
 26751  26751 mylinuxprog RET   wait4 21901/0x558d
 26751  26751 mylinuxprog CALL  munmap(0x7f7ff7efb000,0x4000)
 26751  26751 mylinuxprog RET   munmap 0
 26751  26751 mylinuxprog CALL  pipe2(0x7f7fffffddf0,0x80000)
 26751  26751 mylinuxprog RET   pipe2 0
 26751  26751 mylinuxprog CALL  clone(0x1200011,0,0,0x7f7ff7ef5a10,0x687f)
 26751  26751 mylinuxprog RET   clone 8992/0x2320
  8992   8992 mylinuxprog EMUL  "linux"
  8992   8992 mylinuxprog RET   fork 0
 26751  26751 mylinuxprog CALL  close(4)
 26751  26751 mylinuxprog RET   close 0
 26751  26751 mylinuxprog CALL  fcntl(3,F_SETFD,0)
 26751  26751 mylinuxprog RET   fcntl 0
 26751  26751 mylinuxprog CALL  fstat64(3,0x7f7fffffdd10)
 26751  26751 mylinuxprog RET   fstat64 0
 26751  26751 mylinuxprog CALL  mmap(0,0x4000,PROT_READ|PROT_WRITE,0x22<PRIVATE,RENAME,FILE,ALIGN=NONE>,0xffffffff,0)
 26751  26751 mylinuxprog RET   mmap 140187597254656/0x7f7ff7efb000
 26751  26751 mylinuxprog CALL  read(3,0x7f7ff7efb000,0x4000)
  8992   8992 mylinuxprog CALL  set_robust_list(0x7f7ff7ef5a20,0x18)
  8992   8992 mylinuxprog RET   set_robust_list 0
 22927  22927 mylinuxprog CALL  exit_group(0)
  8992   8992 mylinuxprog CALL  dup2(4,1)
  8992   8992 mylinuxprog RET   dup2 1
  8992   8992 mylinuxprog CALL  execve(0x7f7ff718d873,0x7f7fffffbd70,0x7f7fffffea38)
  8992   8992 mylinuxprog NAMI  "/emul/linux/bin/sh"
  8992   8992 mylinuxprog NAMI  "/emul/linux"
  8992   8992 mylinuxprog NAMI  "/emul/linux/lib64/ld-linux-x86-64.so.2"
 26751  26751 mylinuxprog RET   read -1 errno -3 No such process
 26751  26751 mylinuxprog PSIG  SIGKILL SIG_DFL: code=SI_NOINFO
  8992   8992 sh       EMUL  "linux"
[...]


As you can see above (ktrace -si output), the read on fd 3 in 26751 returns
with an error as soon as the child does its execve(), just as if CLOSEEXEC
was set in the child. But the dup2(4,1) should keep the write side open
without CLOSEEXEC. The program does a similar sequence just before
(also forking a shell to execute some command) and it works.
Later when sh tries to write to stdout it gets a SIGPIPE.

I couldn't reproduce this with a simple program.
But it seems that I can't reproduce this clone call. It seems that we are
called with flags 0x1200011, which would translate to
CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID | SIGCHLD,
and a NULL stack pointer.
But when run on linux, this clone syscall straces to
CLONE_VM|CLONE_VFORK|SIGCHLD

I tried writing a program using fork(), vfork() or clone() but
none of them would use the clone() syscall as do my linux binary.
Any idea what could cause clone() to be used this way ?

Also, any idea about this file descriptor issue ?

-- 
Manuel Bouyer <bouyer%antioche.eu.org@localhost>
     NetBSD: 26 ans d'experience feront toujours la difference
--