Messages in this thread | | | Date | Sun, 9 Nov 2003 11:43:22 +0000 | From | Russell King <> | Subject | crashme on ARM - unkillable processes |
| |
Hi,
It seems that running crashme on ARM running 2.6.0-test8 with the following command:
# crashme +2000.4 666 100 1:0:0
results in crashme not running for very long before it locks up thusly:
Subprocess 2: try 20, offset 80 Subprocess 2: Got signal 4 illegal instruction Subprocess 2: Barfed Subprocess 2: try 21, offset 84 Subprocess 2: Got signal 11 segmentation violation Subprocess 2: Barfed Subprocess 2: try 22, offset 88 time limit reached on pid 1704 0x6A8. using kill.
At this point, PID1704 refuses to die.
Looking at the output of sysrq-p and sysrq-t, it would appear that the subprocess is receiving SIGILL after SIGILL after SIGILL, virtually continuously.
I suspect that either crashme's signal handler got corrupted somehow, or else the longjmp out of the handler is not allowing the next signal to be dequeued.
Looking at next_signal(), the kernel treats signals 1-8 as having higher priority than signal 9. Since we only ever dequeue one signal on return to user space, we always find the SIGILL before SIGKILL, and the kill signal remains indefinitely queued. When considering the situations where we deliver signals to processes, this means that if a process makes both no further system calls and receives no interrupts between SIGILL delivery and the next SIGILL being generated, the SIGKILL will not be delivered.
I, therefore, put it to linux-kernel that this is a potential DoS attack. A normal user space program can fork() multiple instances of itself, and then use this technique to place a heavy CPU intensive load on the machine, and the result could be a hundred or so unkillable processes.
Resource limits on the number of processes a user can create limit the effect, but you will still end up with a number of unkillable processes at the end of the day.
-- Russell King Linux kernel 2.6 ARM Linux - http://www.arm.linux.org.uk/ maintainer of: 2.6 PCMCIA - http://pcmcia.arm.linux.org.uk/ 2.6 Serial core - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |