Repository navigation
Conversation
When frida-server runs under `adb shell`, its stdin and stdout are the same socket. The crash monitor's logcat inherited that socket, so when frida-server died abnormally, logcat kept it open and the host's `adb shell` never saw EOF. Let the child get /dev/null for stdin instead, like it would without STDIN_INHERIT. Logcat has no use for stdin anyway.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When frida-server is started as
adb shell /data/local/tmp/frida-server, adbdhands it a single socket for both stdin and stdout. The crash monitor then
starts
logcat -b crash -BwithSTDIN_INHERIT, so logcat ends up holding acopy of that socket.
If frida-server dies abnormally (SIGKILL, SIGSEGV), logcat is reparented to
init but keeps holding that socket, so the host-side
adb shellkeeps waitinginstead of returning.
The crash monitor has no use for frida-server's stdin, so don't inherit it.
With neither
STDIN_INHERITnorSTDIN_PIPEset, GSubprocess hands the child/dev/null.This change only affects the GSubprocess fallback; the SuperSU spawning path
is unchanged.
Fixes #1288.
Verification
Originally reported on an Android 16 x86_64 emulator (API 36) with
frida-server 17.26.0, where SIGKILL and SIGSEGV behave the same.
Reproduced here on an Android 14 x86_64 emulator (LDPlayer), frida-server
17.24.1, SIGKILL, over adb:
kill -9of frida-serversocket:[47368]— the same socket as frida-server's fd 0 and fd 1adb shellclient stayed alive until logcat was killed, then exited 137</dev/null(control)/dev/nulladb shellclient exited immediately with 137, even though logcat was left runningThe control only changes the stdin setup; it establishes the mechanism, not the
patched binary.
Finally, the GLib semantics the patch relies on, checked by spawning through
GSubprocess on Linux:
STDIN_INHERIT | STDOUT_PIPE | STDERR_SILENCESTDOUT_PIPE | STDERR_SILENCE/dev/nullI couldn't build frida-core on this machine (no Vala/meson toolchain), so the
patched frida-server itself was not built or run.