* Re: [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced()
2022-07-06 10:16 [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() Sven Schnelle
@ 2022-07-06 10:44 ` Peter Zijlstra
2022-07-06 11:04 ` Oleg Nesterov
` (2 subsequent siblings)
3 siblings, 0 replies; 6+ messages in thread
From: Peter Zijlstra @ 2022-07-06 10:44 UTC (permalink / raw)
To: Sven Schnelle
Cc: Oleg Nesterov, Steven Rostedt, Alexander Gordeev,
Eric W. Biederman, Kees Cook, linux-kernel
On Wed, Jul 06, 2022 at 12:16:25PM +0200, Sven Schnelle wrote:
> CI reported the following splat while running the strace testsuite:
>
> [ 3976.640309] WARNING: CPU: 1 PID: 3570031 at kernel/ptrace.c:272 ptrace_check_attach+0x12e/0x178
> [ 3976.640391] CPU: 1 PID: 3570031 Comm: strace Tainted: G OE 5.19.0-20220624.rc3.git0.ee819a77d4e7.300.fc36.s390x #1
> [ 3976.640410] Hardware name: IBM 3906 M04 704 (z/VM 7.1.0)
> [ 3976.640452] Call Trace:
> [ 3976.640454] [<00000000ab4b645a>] ptrace_check_attach+0x132/0x178
> [ 3976.640457] ([<00000000ab4b6450>] ptrace_check_attach+0x128/0x178)
> [ 3976.640460] [<00000000ab4b6cde>] __s390x_sys_ptrace+0x86/0x160
> [ 3976.640463] [<00000000ac03fcec>] __do_syscall+0x1d4/0x200
> [ 3976.640468] [<00000000ac04e312>] system_call+0x82/0xb0
> [ 3976.640470] Last Breaking-Event-Address:
> [ 3976.640471] [<00000000ab4ea3c8>] wait_task_inactive+0x98/0x190
>
> This is because JOBCTL_TRACED is set, but the task is not in TASK_TRACED
> state. Caused by ptrace_unfreeze_traced() which does:
>
> task->jobctl &= ~TASK_TRACED
>
> but it should be:
>
> task->jobctl &= ~JOBCTL_TRACED
>
> Fixes: 31cae1eaae4f ("sched,signal,ptrace: Rework TASK_TRACED, TASK_STOPPED state")
> Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> ---
> kernel/ptrace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> index 156a99283b11..1893d909e45c 100644
> --- a/kernel/ptrace.c
> +++ b/kernel/ptrace.c
> @@ -222,7 +222,7 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
> if (lock_task_sighand(task, &flags)) {
> task->jobctl &= ~JOBCTL_PTRACE_FROZEN;
> if (__fatal_signal_pending(task)) {
> - task->jobctl &= ~TASK_TRACED;
> + task->jobctl &= ~JOBCTL_TRACED;
> wake_up_state(task, __TASK_TRACED);
> }
> unlock_task_sighand(task, &flags);
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced()
2022-07-06 10:16 [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() Sven Schnelle
2022-07-06 10:44 ` Peter Zijlstra
@ 2022-07-06 11:04 ` Oleg Nesterov
2022-07-06 11:13 ` Peter Zijlstra
2022-07-06 12:48 ` Alexander Gordeev
2022-07-06 21:15 ` Eric W. Biederman
3 siblings, 1 reply; 6+ messages in thread
From: Oleg Nesterov @ 2022-07-06 11:04 UTC (permalink / raw)
To: Sven Schnelle
Cc: Peter Zijlstra, Steven Rostedt, Alexander Gordeev,
Eric W. Biederman, Kees Cook, linux-kernel
On 07/06, Sven Schnelle wrote:
>
> --- a/kernel/ptrace.c
> +++ b/kernel/ptrace.c
> @@ -222,7 +222,7 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
> if (lock_task_sighand(task, &flags)) {
> task->jobctl &= ~JOBCTL_PTRACE_FROZEN;
> if (__fatal_signal_pending(task)) {
> - task->jobctl &= ~TASK_TRACED;
> + task->jobctl &= ~JOBCTL_TRACED;
Heh. I have read this code many times, but I'm afraid I could read it
1000 times more and didn't notice the problem ;)
Thanks!
Oleg.
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced()
2022-07-06 11:04 ` Oleg Nesterov
@ 2022-07-06 11:13 ` Peter Zijlstra
0 siblings, 0 replies; 6+ messages in thread
From: Peter Zijlstra @ 2022-07-06 11:13 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Sven Schnelle, Steven Rostedt, Alexander Gordeev,
Eric W. Biederman, Kees Cook, linux-kernel
On Wed, Jul 06, 2022 at 01:04:38PM +0200, Oleg Nesterov wrote:
> On 07/06, Sven Schnelle wrote:
> >
> > --- a/kernel/ptrace.c
> > +++ b/kernel/ptrace.c
> > @@ -222,7 +222,7 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
> > if (lock_task_sighand(task, &flags)) {
> > task->jobctl &= ~JOBCTL_PTRACE_FROZEN;
> > if (__fatal_signal_pending(task)) {
> > - task->jobctl &= ~TASK_TRACED;
> > + task->jobctl &= ~JOBCTL_TRACED;
>
> Heh. I have read this code many times, but I'm afraid I could read it
> 1000 times more and didn't notice the problem ;)
Heh, same here, I've read it today and didn't spot the problem. Brains
are weird.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced()
2022-07-06 10:16 [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() Sven Schnelle
2022-07-06 10:44 ` Peter Zijlstra
2022-07-06 11:04 ` Oleg Nesterov
@ 2022-07-06 12:48 ` Alexander Gordeev
2022-07-06 21:15 ` Eric W. Biederman
3 siblings, 0 replies; 6+ messages in thread
From: Alexander Gordeev @ 2022-07-06 12:48 UTC (permalink / raw)
To: Sven Schnelle
Cc: Oleg Nesterov, Peter Zijlstra, Steven Rostedt, Eric W. Biederman,
Kees Cook, linux-kernel
On Wed, Jul 06, 2022 at 12:16:25PM +0200, Sven Schnelle wrote:
> CI reported the following splat while running the strace testsuite:
>
> [ 3976.640309] WARNING: CPU: 1 PID: 3570031 at kernel/ptrace.c:272 ptrace_check_attach+0x12e/0x178
> [ 3976.640391] CPU: 1 PID: 3570031 Comm: strace Tainted: G OE 5.19.0-20220624.rc3.git0.ee819a77d4e7.300.fc36.s390x #1
> [ 3976.640410] Hardware name: IBM 3906 M04 704 (z/VM 7.1.0)
> [ 3976.640452] Call Trace:
> [ 3976.640454] [<00000000ab4b645a>] ptrace_check_attach+0x132/0x178
> [ 3976.640457] ([<00000000ab4b6450>] ptrace_check_attach+0x128/0x178)
> [ 3976.640460] [<00000000ab4b6cde>] __s390x_sys_ptrace+0x86/0x160
> [ 3976.640463] [<00000000ac03fcec>] __do_syscall+0x1d4/0x200
> [ 3976.640468] [<00000000ac04e312>] system_call+0x82/0xb0
> [ 3976.640470] Last Breaking-Event-Address:
> [ 3976.640471] [<00000000ab4ea3c8>] wait_task_inactive+0x98/0x190
>
> This is because JOBCTL_TRACED is set, but the task is not in TASK_TRACED
> state. Caused by ptrace_unfreeze_traced() which does:
>
> task->jobctl &= ~TASK_TRACED
>
> but it should be:
>
> task->jobctl &= ~JOBCTL_TRACED
>
> Fixes: 31cae1eaae4f ("sched,signal,ptrace: Rework TASK_TRACED, TASK_STOPPED state")
> Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Tested-by: Alexander Gordeev <agordeev@linux.ibm.com>
> ---
> kernel/ptrace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> index 156a99283b11..1893d909e45c 100644
> --- a/kernel/ptrace.c
> +++ b/kernel/ptrace.c
> @@ -222,7 +222,7 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
> if (lock_task_sighand(task, &flags)) {
> task->jobctl &= ~JOBCTL_PTRACE_FROZEN;
> if (__fatal_signal_pending(task)) {
> - task->jobctl &= ~TASK_TRACED;
> + task->jobctl &= ~JOBCTL_TRACED;
> wake_up_state(task, __TASK_TRACED);
> }
> unlock_task_sighand(task, &flags);
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced()
2022-07-06 10:16 [PATCH] ptrace: fix clearing of JOBCTL_TRACED in ptrace_unfreeze_traced() Sven Schnelle
` (2 preceding siblings ...)
2022-07-06 12:48 ` Alexander Gordeev
@ 2022-07-06 21:15 ` Eric W. Biederman
3 siblings, 0 replies; 6+ messages in thread
From: Eric W. Biederman @ 2022-07-06 21:15 UTC (permalink / raw)
To: Sven Schnelle
Cc: Oleg Nesterov, Peter Zijlstra, Steven Rostedt, Alexander Gordeev,
Kees Cook, linux-kernel
Sven Schnelle <svens@linux.ibm.com> writes:
> CI reported the following splat while running the strace testsuite:
>
> [ 3976.640309] WARNING: CPU: 1 PID: 3570031 at kernel/ptrace.c:272 ptrace_check_attach+0x12e/0x178
> [ 3976.640391] CPU: 1 PID: 3570031 Comm: strace Tainted: G OE 5.19.0-20220624.rc3.git0.ee819a77d4e7.300.fc36.s390x #1
> [ 3976.640410] Hardware name: IBM 3906 M04 704 (z/VM 7.1.0)
> [ 3976.640452] Call Trace:
> [ 3976.640454] [<00000000ab4b645a>] ptrace_check_attach+0x132/0x178
> [ 3976.640457] ([<00000000ab4b6450>] ptrace_check_attach+0x128/0x178)
> [ 3976.640460] [<00000000ab4b6cde>] __s390x_sys_ptrace+0x86/0x160
> [ 3976.640463] [<00000000ac03fcec>] __do_syscall+0x1d4/0x200
> [ 3976.640468] [<00000000ac04e312>] system_call+0x82/0xb0
> [ 3976.640470] Last Breaking-Event-Address:
> [ 3976.640471] [<00000000ab4ea3c8>] wait_task_inactive+0x98/0x190
>
> This is because JOBCTL_TRACED is set, but the task is not in TASK_TRACED
> state. Caused by ptrace_unfreeze_traced() which does:
>
> task->jobctl &= ~TASK_TRACED
>
> but it should be:
>
> task->jobctl &= ~JOBCTL_TRACED
That would definitely do it. I had to think about it for a few minutes
to see how it explains some of the stranger behavior but it explains
all of the funny behavior I have seen.
Thank you for tracking this down.
The fact the original bug report was on s390 had me somehow thinking
this was s390 only.
I will double check everything get this in linux-next and then send this
to Linus.
Eric
> Fixes: 31cae1eaae4f ("sched,signal,ptrace: Rework TASK_TRACED, TASK_STOPPED state")
> Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
> ---
> kernel/ptrace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/ptrace.c b/kernel/ptrace.c
> index 156a99283b11..1893d909e45c 100644
> --- a/kernel/ptrace.c
> +++ b/kernel/ptrace.c
> @@ -222,7 +222,7 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
> if (lock_task_sighand(task, &flags)) {
> task->jobctl &= ~JOBCTL_PTRACE_FROZEN;
> if (__fatal_signal_pending(task)) {
> - task->jobctl &= ~TASK_TRACED;
> + task->jobctl &= ~JOBCTL_TRACED;
> wake_up_state(task, __TASK_TRACED);
> }
> unlock_task_sighand(task, &flags);
^ permalink raw reply [flat|nested] 6+ messages in thread