Messages in this thread | | | Date | Sat, 2 Feb 2019 19:30:45 +0100 | From | Jiri Olsa <> | Subject | Re: perf_event_open+clone = unkillable process |
| |
On Fri, Feb 01, 2019 at 06:06:03PM +0100, Dmitry Vyukov wrote: > On Fri, Feb 1, 2019 at 5:48 PM Dmitry Vyukov <dvyukov@google.com> wrote: > > > > Hello, > > > > The following program creates an unkillable process that eats CPU. > > /proc/pid/stack is empty, I am not sure what other info I can provide. > > > > Tested is on upstream commit 4aa9fc2a435abe95a1e8d7f8c7b3d6356514b37a. > > Config is attached. > > Looking through other reproducers that create unkillable processes, I > think I found a much simpler reproducer (below). It's single threaded > and just setups SIGBUS handler and does timer_create+timer_settime to > send repeated SIGBUS. The resulting process can't be killed with > SIGKILL. > +Thomas for timers.
nice, I managed to kill it by strace ;-)
[jolsa@krava perf]$ strace -p 10725 strace: Process 10725 attached --- stopped by SIGBUS --- --- stopped by SIGBUS --- --- stopped by SIGBUS --- --- stopped by SIGBUS --- +++ killed by SIGINT +++
+Oleg
jirka
> > > // autogenerated by syzkaller (https://github.com/google/syzkaller) > > #define _GNU_SOURCE > > #include <endian.h> > #include <setjmp.h> > #include <signal.h> > #include <stdint.h> > #include <stdio.h> > #include <stdlib.h> > #include <string.h> > #include <sys/syscall.h> > #include <sys/types.h> > #include <unistd.h> > > static __thread int skip_segv; > static __thread jmp_buf segv_env; > > static void segv_handler(int sig, siginfo_t* info, void* ctx) > { > uintptr_t addr = (uintptr_t)info->si_addr; > const uintptr_t prog_start = 1 << 20; > const uintptr_t prog_end = 100 << 20; > if (__atomic_load_n(&skip_segv, __ATOMIC_RELAXED) && > (addr < prog_start || addr > prog_end)) { > _longjmp(segv_env, 1); > } > exit(sig); > } > > static void install_segv_handler(void) > { > struct sigaction sa; > memset(&sa, 0, sizeof(sa)); > sa.sa_handler = SIG_IGN; > syscall(SYS_rt_sigaction, 0x20, &sa, NULL, 8); > syscall(SYS_rt_sigaction, 0x21, &sa, NULL, 8); > memset(&sa, 0, sizeof(sa)); > sa.sa_sigaction = segv_handler; > sa.sa_flags = SA_NODEFER | SA_SIGINFO; > sigaction(SIGSEGV, &sa, NULL); > sigaction(SIGBUS, &sa, NULL); > } > > int main(void) > { > syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0); > install_segv_handler(); > int tid = syscall(__NR_gettid); > *(uint64_t*)0x20000000 = 0; > *(uint32_t*)0x20000008 = 7; > *(uint32_t*)0x2000000c = 4; > *(uint32_t*)0x20000010 = tid; > syscall(__NR_timer_create, 0, 0x20000000, 0x20000080); > *(uint64_t*)0x2004a000 = 0; > *(uint64_t*)0x2004a008 = 1; > *(uint64_t*)0x2004a010 = 7; > *(uint64_t*)0x2004a018 = 0xe4c; > syscall(__NR_timer_settime, 0, 3, 0x2004a000, 0); > return 0; > }
| |