Re: [syzbot] [io-uring?] WARNING in __secure_computing

[Kees Cook <kees@kernel.org>]

On Wed, Feb 18, 2026 at 09:27:07AM -0700, Jens Axboe wrote:
> On 2/17/26 9:00 PM, syzbot wrote:
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13256722580000
> > [...]
> > WARNING: kernel/seccomp.c:1407 at __secure_computing+0x2ae/0x2e0 kernel/seccomp.c:1407, CPU#1: syz.0.17/6077

This is:

        /* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
        case SECCOMP_MODE_DEAD:
                WARN_ON_ONCE(1);
                do_exit(SIGKILL);
                return -1;

It's nice to see we caught an impossible state! :) Now we just need to
figure out what the repro is doing.

> Not io_uring, no seccomp label that I can find...

Why do you say this? The reproducer sets up io_uring and then calls
seccomp:

int main(void)
{
...
  //  io_uring_enter arguments: [
  //    fd: fd_io_uring (resource)
  //    to_submit: int32 = 0x847ba (4 bytes)
  //    min_complete: int32 = 0x0 (4 bytes)
  //    flags: io_uring_enter_flags = 0xe (8 bytes)
  //    sigmask: nil
  //    size: len = 0x0 (8 bytes)
  //  ]
  syscall(
      __NR_io_uring_enter, /*fd=*/r[1], /*to_submit=*/0x847ba,
      /*min_complete=*/0,
      /*flags=IORING_ENTER_EXT_ARG|IORING_ENTER_SQ_WAIT|IORING_ENTER_SQ_WAKEUP*/
      0xeul, /*sigmask=*/0ul, /*size=*/0ul);
  //  seccomp$SECCOMP_SET_MODE_FILTER_LISTENER arguments: [
  //    op: const = 0x1 (8 bytes)
  //    flags: seccomp_flags_listener = 0x0 (8 bytes)
  //    arg: ptr[in, sock_fprog] {
  //      sock_fprog {
  //        len: len = 0x1 (2 bytes)
  //        pad = 0x0 (6 bytes)
  //        filter: ptr[in, array[sock_filter]] {
  //          array[sock_filter] {
  //            sock_filter {
  //              code: int16 = 0x6 (2 bytes)
  //              jt: int8 = 0xff (1 bytes)
  //              jf: int8 = 0x1 (1 bytes)
  //              k: int32 = 0x3fff0000 (4 bytes)
  //            }
  //          }
  //        }
  //      }
  //    }
  //  ]
  //  returns fd_seccomp
  NONFAILING(*(uint16_t*)0x200000000240 = 1);
  NONFAILING(*(uint64_t*)0x200000000248 = 0x2000000003c0);
  NONFAILING(*(uint16_t*)0x2000000003c0 = 6);
  NONFAILING(*(uint8_t*)0x2000000003c2 = -1);
  NONFAILING(*(uint8_t*)0x2000000003c3 = 1);
  NONFAILING(*(uint32_t*)0x2000000003c4 = 0x3fff0000);
  syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul, /*arg=*/0x200000000240ul);
  return 0;
}

So something has gone weird here, I assume related to seccomp listener
vs io_uring and process death.

-Kees

-- 
Kees Cook