linux-kernel - Re: stack traces and zombie tasks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 15 Dec 2017 07:51:45 -0800
From:   Andy Lutomirski <luto@...nel.org>
To:     Miroslav Benes <mbenes@...e.cz>
Cc:     Andrew Lutomirski <luto@...nel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>, X86 ML <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        live-patching@...r.kernel.org
Subject: Re: stack traces and zombie tasks

On Fri, Dec 15, 2017 at 4:54 AM, Miroslav Benes <mbenes@...e.cz> wrote:
> Hi,
>
> commit 1959a60182f4 ("x86/dumpstack: Pin the target stack when dumping
> it") slightly changed the behaviour of stack traces dumping for zombie
> tasks.
>
> Before the commit (well, this is older SLE12 kernel, but that should not
> matter), if one called 'cat /proc/<zombie pid>/stack', they would get
> something like this
>
>   [<ffffffff8105b877>] do_exit+0x6f7/0xa80
>   [<ffffffff8105bc79>] do_group_exit+0x39/0xa0
>   [<ffffffff8105bcf0>] __wake_up_parent+0x0/0x30
>   [<ffffffff8152dd09>] system_call_fastpath+0x16/0x1b
>   [<00007fd128f9c4f9>] 0x7fd128f9c4f9
>   [<ffffffffffffffff>] 0xffffffffffffffff
>
> After, one gets nothing. The trace is empty. try_get_task_stack() contains
> atomic_inc_not_zero() (CONFIG_THREAD_INFO_IN_TASK is now default on
> x86_64) and because stack_refcount is 0 for a zombie task, it returns
> NULL. Therefore, all save_stack_trace_*() functions return immediately.
>
> I guess that no one has cared about it so far. There is a problem for
> live patching though. save_stack_trace_tsk_reliable() returns -EINVAL for
> the zombie task and its stack is deemed unreliable. It could block our
> transition for quite a long time.
>
> We can skip those tasks in kernel/livepatch/ with a simple test we have in
> kGraft. Skip the task if (task->state == TASK_DEAD && task->on_cpu == 0).
> But you may want to change it generally, so better to ask first.
>

Sounds like a bug in save_stack_trace_tsk_reliable() to me: if the
task has no stack, then the trace is 100% definitely empty :)