linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* fs/proc: Crash observed in next_tgid (fs/proc/base.c)
@ 2019-04-15 12:58 Jitendra Sharma
  2019-04-17  3:38 ` Kees Cook
  2019-04-17 12:11 ` Marc Gonzalez
  0 siblings, 2 replies; 7+ messages in thread
From: Jitendra Sharma @ 2019-04-15 12:58 UTC (permalink / raw)
  To: keescook, mcgrof; +Cc: linux-kernel, linux-fsdevel, linux-arm-msm

Hi Kees Cook/Luis,

We are observing one kernel crash in next_tgid function through 
getdents64 path. Call stack is as shown below:

-000|has_group_leader_pid(inline)
-000|next_tgid(
| [X20] ns = 0xFFFFFF87CABB1AC0,
| [locdesc] iter = (
| [locdesc] tgid = 424,
| [locdesc] task = ?))
| [X21] p = 0xFFFFFFD0FFFFF948
| [X21] task = 0xFFFFFFD0FFFFF948
-001|proc_pid_readdir(
| [X20] file = 0xFFFFFFD1AC60FC40,
| [X19] ctx = 0xFFFFFF8027363E40)
| [X21] ns = 0xFFFFFF87CABB1AC0
-002|proc_root_readdir(
| [X20] file = 0xFFFFFFD1AC60FC40,
| [X19] ctx = 0xFFFFFF8027363E40)
-003|iterate_dir(
| [X19] file = 0xFFFFFFD1AC60FC40,
| [X22] ctx = 0xFFFFFF8027363E40)
| [X23] inode = 0xFFFFFFD1F20246D0
-004|SYSC_getdents64(inline)
-004|sys_getdents64(
| ?,
| ?,
| [X19] count = 4200)
| [X19] count = 4200
| [X20] f = ([X20] file = 0xAC60FC43AC60FC40, [X20] flags = 1207898624)
| [X0] error = -1720
-005|el0_svc_naked(asm)
-->|exception
-006|NUX:0x78C5AD7D38(asm)
---|end of frame


 From this call stack,task: 0xFFFFFFD0FFFFF948, seems to be invalid. 
As(from ramdumps) it doesn't have any valid fields. And while trying to 
access the fields of this task struct in has_group_leader_pid, abort is 
happening.

 From the dumps, its not clear why the task struct is coming to be some 
invalid (Possibly task has already exited).  This issue is observed 
during normal monkey testing for long hours.

Could you please provide some pointers which could help in debugging 
this issue further.


Thanks,

Jitendra

-- 

QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
of Code Aurora Forum, hosted by The Linux Foundation

^ permalink raw reply	[flat|nested] 7+ messages in thread
* Re: fs/proc: Crash observed in next_tgid (fs/proc/base.c)
@ 2019-04-17 18:14 Alexey Dobriyan
  0 siblings, 0 replies; 7+ messages in thread
From: Alexey Dobriyan @ 2019-04-17 18:14 UTC (permalink / raw)
  To: shajit; +Cc: linux-kernel

> Test case: Not some specific test case.

Write 2 programs: one forks, clones, and execs randomly (but not going
out of control), another does open("/proc"), getdents in a loop.
Don't use shell scripts or readdir as they only bring overhead.

Run getdents in a loop and several forkers, see what happens.

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2019-04-18  9:24 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-04-15 12:58 fs/proc: Crash observed in next_tgid (fs/proc/base.c) Jitendra Sharma
2019-04-17  3:38 ` Kees Cook
2019-04-17 11:21   ` Oleg Nesterov
2019-04-17 12:11 ` Marc Gonzalez
2019-04-17 16:58   ` Jitendra Sharma
2019-04-18  9:24     ` Marc Gonzalez
2019-04-17 18:14 Alexey Dobriyan

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).