From: Oleg Nesterov <oleg@redhat.com>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Roland McGrath <roland@hack.frob.com>,
Andrew Morton <akpm@linux-foundation.org>,
"Amanieu d'Antras" <amanieu@gmail.com>,
pmoore@redhat.com, Ingo Molnar <mingo@kernel.org>,
vdavydov@parallels.com, qiaowei.ren@intel.com, dave@stgolabs.net,
Palmer Dabbelt <palmer@dabbelt.com>,
LKML <linux-kernel@vger.kernel.org>,
syzkaller <syzkaller@googlegroups.com>,
Kostya Serebryany <kcc@google.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>
Subject: Re: WARNING in task_participate_group_stop
Date: Mon, 2 Nov 2015 16:33:00 +0100 [thread overview]
Message-ID: <20151102153300.GA21006@redhat.com> (raw)
In-Reply-To: <CACT4Y+Y=hfVib1J6fwFm7Si93LyF2fp+grA5Aw7UgPcG46Yepg@mail.gmail.com>
On 11/02, Dmitry Vyukov wrote:
>
> On Mon, Nov 2, 2015 at 4:13 PM, Oleg Nesterov <oleg@redhat.com> wrote:
> > Hi Dmitry,
> >
> > On 11/02, Dmitry Vyukov wrote:
> >>
> >> WARNING: CPU: 1 PID: 1 at kernel/signal.c:334
> >> task_participate_group_stop+0x157/0x1d0()
> >> Modules linked in:
> >> CPU: 1 PID: 1 Comm: init Not tainted 4.3.0 #48
> >> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> >> ffffffff82e40280 ffff88003eb0fae0 ffffffff819efe55 0000000000000000
> >> ffff88003eb0fb20 ffffffff810ec871 ffffffff8110f4d7 ffff88003eb00000
> >> ffff88003eb20000 0000000000000000 ffff88003eb0fbf8 ffff88003eb20000
> >> Call Trace:
> >> [<ffffffff810eca35>] warn_slowpath_null+0x15/0x20 kernel/panic.c:480
> >> [<ffffffff8110f4d7>] task_participate_group_stop+0x157/0x1d0
> >> kernel/signal.c:334
> >> [<ffffffff81113587>] do_signal_stop+0x1e7/0x6e0 kernel/signal.c:2060
> >> [<ffffffff81116ab7>] get_signal+0x387/0x11b0 kernel/signal.c:2316
> >> [<ffffffff8100cf0d>] do_signal+0x8d/0x19e0 arch/x86/kernel/signal.c:707
> >> [<ffffffff81005d8d>] prepare_exit_to_usermode+0x11d/0x170
> >> arch/x86/entry/common.c:251
> >> [<ffffffff81005e83>] syscall_return_slowpath+0xa3/0x2b0
> >> arch/x86/entry/common.c:317
> >> [<ffffffff82d4f6a7>] int_ret_from_sys_call+0x25/0x8f
> >> arch/x86/entry/entry_64.S:281
> >> ---[ end trace f6697fd630b7c361 ]---
> >>
> >>
> >> The reproducer is (needs to be run as root):
> >>
> >> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> >> #include <sys/ptrace.h>
> >> #include <unistd.h>
> >>
> >> int main()
> >> {
> >> int pid = 1;
> >> ptrace(PTRACE_ATTACH, pid, 0, 0);
> >> ptrace(PTRACE_SETOPTIONS, pid, 0, PTRACE_O_EXITKILL);
> >> sleep(1);
> >> return 0;
> >> }
> >
> > Thanks.
> >
> > Can't reproduce, but at first glance the problem looks clear...
>
> Humm... did you run as root?
Yes,
> It reproduces all the time on my 4.3 kernel VM. Also firmly killed my
> desktop running 3.13.
Yes, it kills init and crashes the kernel. But I do not see the warning.
> >> Yes, it is weird and it kills init right afterwards.
> >
> > Could you confirm that this WARN_ON() happens _after_ the reproducer exits?
> >
> >> But I wasn't able
> >> to figure out what's the root cause (why task does not have
> >> JOBCTL_STOP_PENDING) and maybe the same WARNING can be triggered
> >> without root and/or with other than init process. So still posting it
> >> here.
> >
> > Yes I think you are right. SIGSTOP can race with SIGKILL which (unlike SIGCONT)
> > doesn't clear JOBCTL_STOP_DEQUEUED/PENDING/etc.
> >
> > This is mostly fine, the task won't block in TASK_STOPPED if SIGKILL is pending,
> > but still is not right and leads to the warning above: JOBCTL_STOP_PENDING was not
> > set because do_signal_stop()->task_set_jobctl_pending() checks fatal_signal_pending().
On a second thought, in this particular case (your test-case), SIGSTOP/SIGKILL
do not race, although (so far) I think this doesn't matter. JOBCTL_STOP_PENDING
comes from __ptrace_unlink() when the tracee already has the pending SIGKILL
due to PTRACE_O_EXITKILL.
Now. If the tracee (init) wakes up and dequeues SIGKILL before __ptrace_unlink()
adds JOBCTL_STOP_PENDING, it won't see JOBCTL_STOP_PENDING and probably this is
what happens on my testing machine.
Perhaps __ptrace_unlink() should me more carefull too...
> > Probably the patch below should fix the problem, but I'd like to think more before
> > I send the fix.
>
>
> Will test it.
Great, thanks.
Oleg.
next prev parent reply other threads:[~2015-11-02 14:36 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-02 13:25 WARNING in task_participate_group_stop Dmitry Vyukov
2015-11-02 15:13 ` Oleg Nesterov
2015-11-02 14:21 ` Dmitry Vyukov
2015-11-02 15:33 ` Oleg Nesterov [this message]
2015-11-02 16:36 ` Oleg Nesterov
2015-11-02 18:06 ` Oleg Nesterov
2015-11-04 19:18 ` [PATCH 0/1] (Was: WARNING in task_participate_group_stop) Oleg Nesterov
2015-11-04 19:19 ` [PATCH 1/1] signal: kill the obsolete SIGNAL_UNKILLABLE check in complete_signal() Oleg Nesterov
2015-11-05 1:21 ` Andrew Morton
2015-11-05 16:08 ` Oleg Nesterov
2015-11-05 18:02 ` Oleg Nesterov
2017-10-30 19:12 WARNING in task_participate_group_stop syzbot
2017-10-30 19:20 ` Dmitry Vyukov
2017-10-31 16:34 ` Oleg Nesterov
2017-11-01 5:55 ` Dmitry Vyukov
2017-11-02 17:01 ` Oleg Nesterov
2017-11-06 11:02 ` Dmitry Vyukov
2017-11-06 11:25 ` Jamie Iles
2017-11-06 11:56 ` Dmitry Vyukov
2017-11-06 12:26 ` Jamie Iles
2017-11-06 14:31 ` Oleg Nesterov
2017-11-07 17:31 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20151102153300.GA21006@redhat.com \
--to=oleg@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=amanieu@gmail.com \
--cc=dave@stgolabs.net \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=palmer@dabbelt.com \
--cc=pmoore@redhat.com \
--cc=qiaowei.ren@intel.com \
--cc=roland@hack.frob.com \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=vdavydov@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).