0

I created a program similar to "strace" which is able to log the syscalls.
Also I installed a webserver and watched the syscalls from 'strace' and from my program and compared them.
For each program, I initiated to the webserver a simple HTTP GET request which created several syscalls.

In my program:

I noticed that in a certain accept4() execution, the return value is (-11), meaning (minus 11) !
But that (-11) return value for accept4() should never happen.
I can't figure out why I get (-11) in register RAX when the accept4() syscall exits.

Attached the log of my program.
There are two accept4() syscalls (syscall number 288):

  • Line 14: First accept4() syscall, entry.
  • Line 18: First accept4() syscall, exit.
  • Line 86: Second accept4() syscall, entry.
  • Line 90: Second accept4() syscall, exit.

In the 'strace' program:

The suspected accept4() returns (-1) which 'strace' identifies as EAGAIN.
But according to 'errno' program, then:

~$ errno 1
EPERM 1 Operation not permitted
~$ errno 11
EAGAIN 11 Resource temporarily unavailable

Attached the log of the 'strace' program.
There are two accept4() syscalls (syscall number 288):

  • Line 4: First accept4() syscall.
  • Line 15: Second accept4() syscall.

My questions are:

  1. Why strace reports a different return value than my program?
  2. How should I properly interpret the (-11) that the second accept4() syscall returns?

Additional technical data:

Using gcc compiler with flags "-g -Wall" and linker flag "-lm".

The important data from "gcc -v" is:

Target: x86_64-linux-gnu
gcc version 11.3.0 (Ubuntu 11.3.0-1ubuntu1~22.04)

Include paths from "cpp -v":

/usr/lib/gcc/x86_64-linux-gnu/11/include
/usr/local/include
/usr/include/x86_64-linux-gnu
/usr/include
user554179
  • 1

1 Answers1

0

strace seems to show all error returns as -1 along with the error code:

$ strace ls /enoent
...
stat("/enoent", 0x55c15dfbb150)         = -1 ENOENT (No such file or directory)

That's what the system call wrapper functions return anyway, so it's not exactly wrong, even though the kernel returns just one value. (Though looking at the tables in the syscall(2) man page, there's variation between architectures on how the return values and errors are returned from the kernel.)

Showing the values according to the user space interface might just be a usability choice, but I don't know.

ilkkachu
  • 133,243
  • 15
  • 236
  • 397