Re: [syzbot] [io-uring?] WARNING in __secure_computing

Kees Cook
2026-02-19T18:53:58Z

On Wed, Feb 18, 2026 at 09:27:07AM -0700, Jens Axboe wrote:
> On 2/17/26 9:00 PM, syzbot wrote:
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13256722580000
> > [...]
> > WARNING: kernel/seccomp.c:1407 at __secure_computing+0x2ae/0x2e0 kernel/seccomp.c:1407, CPU#1: syz.0.17/6077

This is:

/* Surviving SECCOMP_RET_KILL_* must be proactively impossible. */
case SECCOMP_MODE_DEAD:
WARN_ON_ONCE(1);
do_exit(SIGKILL);
return -1;

It's nice to see we caught an impossible state! :) Now we just need to
figure out what the repro is doing.

> Not io_uring, no seccomp label that I can find...

Why do you say this? The reproducer sets up io_uring and then calls
seccomp:

int main(void)
{
...
// io_uring_enter arguments: [
// fd: fd_io_uring (resource)
// to_submit: int32 = 0x847ba (4 bytes)
// min_complete: int32 = 0x0 (4 bytes)
// flags: io_uring_enter_flags = 0xe (8 bytes)
// sigmask: nil
// size: len = 0x0 (8 bytes)
// ]
syscall(
__NR_io_uring_enter, /*fd=*/r[1], /*to_submit=*/0x847ba,
/*min_complete=*/0,
/*flags=IORING_ENTER_EXT_ARG|IORING_ENTER_SQ_WAIT|IORING_ENTER_SQ_WAKEUP*/
0xeul, /*sigmask=*/0ul, /*size=*/0ul);
// seccomp$SECCOMP_SET_MODE_FILTER_LISTENER arguments: [
// op: const = 0x1 (8 bytes)
// flags: seccomp_flags_listener = 0x0 (8 bytes)
// arg: ptr[in, sock_fprog] {
// sock_fprog {
// len: len = 0x1 (2 bytes)
// pad = 0x0 (6 bytes)
// filter: ptr[in, array[sock_filter]] {
// array[sock_filter] {
// sock_filter {
// code: int16 = 0x6 (2 bytes)
// jt: int8 = 0xff (1 bytes)
// jf: int8 = 0x1 (1 bytes)
// k: int32 = 0x3fff0000 (4 bytes)
// }
// }
// }
// }
// }
// ]
// returns fd_seccomp
NONFAILING(*(uint16_t*)0x200000000240 = 1);
NONFAILING(*(uint64_t*)0x200000000248 = 0x2000000003c0);
NONFAILING(*(uint16_t*)0x2000000003c0 = 6);
NONFAILING(*(uint8_t*)0x2000000003c2 = -1);
NONFAILING(*(uint8_t*)0x2000000003c3 = 1);
NONFAILING(*(uint32_t*)0x2000000003c4 = 0x3fff0000);
syscall(__NR_seccomp, /*op=*/1ul, /*flags=*/0ul, /*arg=*/0x200000000240ul);
return 0;
}

So something has gone weird here, I assume related to seccomp listener
vs io_uring and process death.

-Kees

--
Kees Cook