DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org A01A6601A1
Subject: Re: Query: Crash is coming during /prod/PID/stat and do_exit of same
 task
From: "Kohli, Gaurav" <gkohli@codeaurora.org>
To: peterz@infradead.org, john.ogness@linutronix.de, mingo@kernel.org
Cc: linux-kernel@vger.kernel.org, linux-arm-msm@vger.kernel.org
References: <36ea8b88-4786-dbb2-6b89-15f9801e9c86@codeaurora.org>
Message-ID: <fa3d228f-cd5f-2d5a-f3ab-6e44460a7a28@codeaurora.org>
Date: Mon, 15 Jan 2018 15:34:45 +0530
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.2
MIME-Version: 1.0
In-Reply-To: <36ea8b88-4786-dbb2-6b89-15f9801e9c86@codeaurora.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org

Hi John, Ingo

As still we are seeing race between do_task_stat and do_exit of task, 
Can't we have to
put more strict check in case, if stack pointer is NULL in below code :

                 if (permitted && (task->flags & PF_DUMPCORE)) {
                         eip = KSTK_EIP(task);
                         esp = KSTK_ESP(task);
                 }

Regards
Gaurav


On 1/9/2018 7:03 PM, Kohli, Gaurav wrote:
> HI ,
>
> We are seeing crash in do_task_stat while accessing stack pointer, It 
> seems same task has already completed do_exit call.
> So it seems a race between them:
>
> Below is the crash trace:
> 49750.534377] Kernel BUG at ffffff8e7a4c53a8 [verbose debug info 
> unavailable]
> [49750.534394] task: ffffffe7b4475580 task.stack: ffffffe7a5f0c000
> [49750.534400] PC is at do_task_stat+0x740/0x908
> [49750.534402] LR is at do_task_stat+0xa4/0x908
> [49750.534403] pc : [<ffffff8e7a4c53a8>] lr : [<ffffff8e7a4c4d0c>] 
> pstate: 80400145
> [49750.534404] sp : ffffffe7a5f0fbd0
>
> and here is stack trace on that core:
>
> -000|user_stack_pointer(inline)
> -000|do_task_stat(
>     |    m = 0xFFFFFFE7A5CD7380,
>     |    ns = 0xFFFFFF8E7C43C748,
>     |  ?,
>     |    task = 0xFFFFFFE80D8C2280,
>     |  ?)
>     |  tty_pgrp = 0
>     |  ppid = 2084696064
>     |  sid = 0
>     |  mm = 0xFFFFFFE7B4424140
>     |  tcomm = (84, 9, 71, 122, 142, 255, 255, 255, 48, 253, 240, 165, 
> 231, 255, 255, 255)
>     |  flags = 18446743969119403392
> -001|proc_tgid_stat(
>     |    m = 0xFFFFFFE7A5CD7380,
>     |  ?,
>
> Below are task stats which shows , process completed the do_exit call:
> struct task_struct.flags -x 0xFFFFFFE80D8C2280
>   flags = 0x40870c
>
> crash_64> struct task_struct.exit_code -x 0xFFFFFFE80D8C2280
>   exit_code = 0x6
>
>    struct task_struct.state -x 0xFFFFFFE80D8C2280
>   state = 0x40
>
> In our build both patches are there ,
> fs/proc: report eip/esp in /prod/PID/stat for coredumping
>
> and also  task.state has already set PF_DUMPCORE as it got the sigabrt 
> signal.
>
> Regards
> Gaurav
>
>
> -- Qualcomm India Private Limited, on behalf of Qualcomm Innovation 
> Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation 
> Collaborative Project.

-- Qualcomm India Private Limited, on behalf of Qualcomm Innovation 
Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation 
Collaborative Project.