Re: [GIT PULL] execve updates for v6.12-rc1

Vegard Nossum
2024-09-26T18:29:24Z

On 16/09/2024 10:39, Kees Cook wrote:
> Hi Linus,
>
> Please pull these execve updates for v6.12-rc1. Note there is a trivial
> merge conflict between this and mm, which was resolved in -next with:
> https://lore.kernel.org/linux-next/20240909171843.78c294da@canb.auug.org.au/
>
> Thanks!
>
> -Kees
>
> The following changes since commit de9c2c66ad8e787abec7c9d7eff4f8c3cdd28aed:
>
> Linux 6.11-rc2 (2024-08-04 13:50:53 -0700)
>
> are available in the Git repository at:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git tags/execve-v6.12-rc1
>
> for you to fetch changes up to 44f65d900698278a8451988abe0d5ca37fd46882:
>
> binfmt_elf: mseal address zero (2024-08-14 09:56:48 -0700)
>
> ----------------------------------------------------------------
> execve updates for v6.12-rc1
>
> - binfmt_elf: Dump smaller VMAs first in ELF cores (Brian Mak)
>
> - binfmt_elf: mseal address zero (Jeff Xu)
>
> - binfmt_elf, coredump: Log the reason of the failed core dumps
> (Roman Kisel)

Hi,

This last commit seems to introduce a regression for me, creating a
completely unkillable process (but idle/0% CPU) that is stuck here:

$ sudo cat /proc/2453/stack
[<0>] do_exit+0xee/0xac0
[<0>] do_group_exit+0x34/0x90
[<0>] get_signal+0xa63/0xa70
[<0>] arch_do_signal_or_restart+0x42/0x260
[<0>] irqentry_exit_to_user_mode+0x1e0/0x250
[<0>] irqentry_exit+0x43/0x50
[<0>] exc_page_fault+0x94/0x1d0
[<0>] asm_exc_page_fault+0x27/0x30

$ cat /proc/2453/status
...
State: I (idle)
...
TracerPid: 0
...
Kthread: 0
VmPeak: 2240 kB
VmSize: 2240 kB
VmLck: 0 kB
VmPin: 0 kB
VmHWM: 568 kB
VmRSS: 568 kB
RssAnon: 136 kB
RssFile: 432 kB
RssShmem: 0 kB
VmData: 420 kB
VmStk: 132 kB
VmExe: 1644 kB
VmLib: 16 kB
VmPTE: 60 kB
VmSwap: 0 kB
HugetlbPages: 0 kB
CoreDumping: 1
THP_enabled: 1
untag_mask: 0xffffffffffffffff
Threads: 1
SigQ: 0/62622
SigPnd: 0000000000000100
ShdPnd: 0000000000000100
SigBlk: 0000000000000000
SigIgn: 0000000000000000
SigCgt: 00000000000020db
...

The process is so unkillable I can't even shut my laptop down without
holding the power button for 5 seconds -- apart from that, everything
works correctly.

Bisection ended up here:

# first bad commit: [fb97d2eb542faf19a8725afbd75cbc2518903210]
binfmt_elf, coredump: Log the reason of the failed core dumps

I have to admit I don't immediately see what's wrong with the patch.

Vegard