linux-kernel - Re: stack traces and zombie tasks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Dec 2017 08:50:26 +0100
From:   Ingo Molnar <mingo@...nel.org>
To:     Miroslav Benes <mbenes@...e.cz>
Cc:     Josh Poimboeuf <jpoimboe@...hat.com>,
        Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        live-patching@...r.kernel.org
Subject: Re: stack traces and zombie tasks


* Miroslav Benes <mbenes@...e.cz> wrote:

> On Sun, 17 Dec 2017, Josh Poimboeuf wrote:
> 
> > On Fri, Dec 15, 2017 at 07:51:45AM -0800, Andy Lutomirski wrote:
> > > On Fri, Dec 15, 2017 at 4:54 AM, Miroslav Benes <mbenes@...e.cz> wrote:
> > > > Hi,
> > > >
> > > > commit 1959a60182f4 ("x86/dumpstack: Pin the target stack when dumping
> > > > it") slightly changed the behaviour of stack traces dumping for zombie
> > > > tasks.
> > > >
> > > > Before the commit (well, this is older SLE12 kernel, but that should not
> > > > matter), if one called 'cat /proc/<zombie pid>/stack', they would get
> > > > something like this
> > > >
> > > >   [<ffffffff8105b877>] do_exit+0x6f7/0xa80
> > > >   [<ffffffff8105bc79>] do_group_exit+0x39/0xa0
> > > >   [<ffffffff8105bcf0>] __wake_up_parent+0x0/0x30
> > > >   [<ffffffff8152dd09>] system_call_fastpath+0x16/0x1b
> > > >   [<00007fd128f9c4f9>] 0x7fd128f9c4f9
> > > >   [<ffffffffffffffff>] 0xffffffffffffffff
> > > >
> > > > After, one gets nothing. The trace is empty. try_get_task_stack() contains
> > > > atomic_inc_not_zero() (CONFIG_THREAD_INFO_IN_TASK is now default on
> > > > x86_64) and because stack_refcount is 0 for a zombie task, it returns
> > > > NULL. Therefore, all save_stack_trace_*() functions return immediately.
> > > >
> > > > I guess that no one has cared about it so far. There is a problem for
> > > > live patching though. save_stack_trace_tsk_reliable() returns -EINVAL for
> > > > the zombie task and its stack is deemed unreliable. It could block our
> > > > transition for quite a long time.
> > > >
> > > > We can skip those tasks in kernel/livepatch/ with a simple test we have in
> > > > kGraft. Skip the task if (task->state == TASK_DEAD && task->on_cpu == 0).
> > > > But you may want to change it generally, so better to ask first.
> > > >
> > > 
> > > Sounds like a bug in save_stack_trace_tsk_reliable() to me: if the
> > > task has no stack, then the trace is 100% definitely empty :)
> > 
> > I would agree with that, something like the following should fix it?
> > 
> > diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c
> > index 77835bc021c7..20161ef53537 100644
> > --- a/arch/x86/kernel/stacktrace.c
> > +++ b/arch/x86/kernel/stacktrace.c
> > @@ -164,8 +164,12 @@ int save_stack_trace_tsk_reliable(struct task_struct *tsk,
> >  {
> >  	int ret;
> >  
> > +	/*
> > +	 * If the task doesn't have a stack (e.g., a zombie), the stack is
> > +	 * "reliably" empty.
> > +	 */
> >  	if (!try_get_task_stack(tsk))
> > -		return -EINVAL;
> > +		return 0;
> >  
> >  	ret = __save_stack_trace_reliable(trace, tsk);
> 
> This obviously fixes the problem, so you can add
> 
> Reported-and-tested-by: Miroslav Benes <mbenes@...e.cz>

Great.

Josh, mind sending a changelogged version, or should I distill a commit out of 
this discussion, for tip:x86/urgent?

Thanks,

	Ingo