WARNING in do_notify_parent (kernel/signal.c:2174)

[Jie Zhu]

Hello,

I'm reporting a kernel WARNING in do_notify_parent() (kernel/signal.c:2174)
that is reliably triggered by a specific combination of clone flags. Found
with syzkaller.

Tested on the latest upstream tree:
  commit: 27d128c1cff6 ("Merge tag 'trace-ring-buffer-v7.1-3'")
  config: defconfig + KASAN (outline) + KCOV

The WARNING triggers on every run, not a race.

Call Trace:

  WARNING: kernel/signal.c:2174 at do_notify_parent+0xbe3/0xc10
  CPU: 1 UID: 0 PID: 350 Comm: do_notify_paren Not tainted
7.0.0-g27d128c1cff6 #3 PREEMPT(lazy)
  Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, 1996)
  RIP: 0010:do_notify_parent+0xbe3/0xc10
  Call Trace:
   <TASK>
   do_exit+0x124b/0x18b0
   __x64_sys_exit+0x30/0x30
   x64_sys_call+0x1880/0x1880
   do_syscall_64+0x10c/0x640
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

The WARNING at kernel/signal.c:2174 is one of the three WARN_ON_ONCE checks
at the top of do_notify_parent():

  WARN_ON_ONCE(!valid_signal(sig));            /* line 2174 */
  WARN_ON_ONCE(task_is_stopped_or_traced(tsk));/* line 2178 */
  WARN_ON_ONCE(!tsk->ptrace &&                 /* line 2180 */
               !thread_group_empty(tsk));

The reproducing clone flags are:
  CLONE_NEWTIME | CLONE_CHILD_SETTID | CLONE_VFORK | CLONE_FILES
  (0x1004480, note CLONE_VM is stripped by the syz_clone helper)

In exit_notify() (kernel/exit.c:755), the non-ptraced thread_group_leader
path calls do_notify_parent() guarded by thread_group_empty(). However, the
specific flag combination appears to reach do_notify_parent() in a state that
violates one of its preconditions.

Syzkaller reproducer (syz program):

  syz_clone(0x1004580, 0x0, 0x0, 0x0, 0x0, 0x0)

C reproducer below. It sets up a sandbox with PID/net/mount namespaces, then
does a single clone() call with the above flags. Triggers on every run.

Best,
Jie

---
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE

#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/time.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>

#include <linux/capability.h>

static bool write_file(const char* file, const char* what, ...)
{
    char buf[1024];
    va_list args;
    va_start(args, what);
    vsnprintf(buf, sizeof(buf), what, args);
    va_end(args);
    buf[sizeof(buf) - 1] = 0;
    int len = strlen(buf);
    int fd = open(file, O_WRONLY | O_CLOEXEC);
    if (fd == -1)
        return false;
    if (write(fd, buf, len) != len) {
        int err = errno;
        close(fd);
        errno = err;
        return false;
    }
    close(fd);
    return true;
}

static void setup_gadgetfs();
static void setup_binderfs();
static void setup_fusectl();
static void sandbox_common_mount_tmpfs(void)
{
    write_file("/proc/sys/fs/mount-max", "100000");
    if (mkdir("./syz-tmp", 0777))
    exit(1);
    if (mount("", "./syz-tmp", "tmpfs", 0, NULL))
    exit(1);
    if (mkdir("./syz-tmp/newroot", 0777))
    exit(1);
    if (mkdir("./syz-tmp/newroot/dev", 0700))
    exit(1);
    unsigned bind_mount_flags = MS_BIND | MS_REC | MS_PRIVATE;
    if (mount("/dev", "./syz-tmp/newroot/dev", NULL, bind_mount_flags, NULL))
    exit(1);
    if (mkdir("./syz-tmp/newroot/proc", 0700))
    exit(1);
    if (mount("syz-proc", "./syz-tmp/newroot/proc", "proc", 0, NULL))
    exit(1);
    if (mkdir("./syz-tmp/newroot/selinux", 0700))
    exit(1);
    const char* selinux_path = "./syz-tmp/newroot/selinux";
    if (mount("/selinux", selinux_path, NULL, bind_mount_flags, NULL)) {
        if (errno != ENOENT)
    exit(1);
        if (mount("/sys/fs/selinux", selinux_path, NULL,
bind_mount_flags, NULL) && errno != ENOENT)
    exit(1);
    }
    if (mkdir("./syz-tmp/newroot/sys", 0700))
    exit(1);
    if (mount("/sys", "./syz-tmp/newroot/sys", 0, bind_mount_flags, NULL))
    exit(1);
    if (mount("/sys/kernel/debug",
"./syz-tmp/newroot/sys/kernel/debug", NULL, bind_mount_flags, NULL) &&
errno != ENOENT)
    exit(1);
    if (mount("/sys/fs/smackfs", "./syz-tmp/newroot/sys/fs/smackfs",
NULL, bind_mount_flags, NULL) && errno != ENOENT)
    exit(1);
    if (mount("/proc/sys/fs/binfmt_misc",
"./syz-tmp/newroot/proc/sys/fs/binfmt_misc", NULL, bind_mount_flags,
NULL) && errno != ENOENT)
    exit(1);
    if (mkdir("./syz-tmp/newroot/syz-inputs", 0700))
    exit(1);
    if (mount("/syz-inputs", "./syz-tmp/newroot/syz-inputs", NULL,
bind_mount_flags | MS_RDONLY, NULL) && errno != ENOENT)
    exit(1);
    if (mkdir("./syz-tmp/pivot", 0777))
    exit(1);
    if (syscall(SYS_pivot_root, "./syz-tmp", "./syz-tmp/pivot")) {
        if (chdir("./syz-tmp"))
    exit(1);
    } else {
        if (chdir("/"))
    exit(1);
        if (umount2("./pivot", MNT_DETACH))
    exit(1);
    }
    if (chroot("./newroot"))
    exit(1);
    if (chdir("/"))
    exit(1);
    setup_gadgetfs();
    setup_binderfs();
    setup_fusectl();
}

static void setup_gadgetfs()
{
    if (mkdir("/dev/gadgetfs", 0777)) {
    }
    if (mount("gadgetfs", "/dev/gadgetfs", "gadgetfs", 0, NULL)) {
    }
}

static void setup_fusectl()
{
    if (mount(0, "/sys/fs/fuse/connections", "fusectl", 0, 0)) {
    }
}

static void setup_binderfs()
{
    if (mkdir("/dev/binderfs", 0777)) {
    }
    if (mount("binder", "/dev/binderfs", "binder", 0, NULL)) {
    }
    if (symlink("/dev/binderfs", "./binderfs")) {
    }
}

static void loop();

static void sandbox_common()
{
    prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
    if (getppid() == 1)
    exit(1);
    struct rlimit rlim;
    rlim.rlim_cur = rlim.rlim_max = (200 << 20);
    setrlimit(RLIMIT_AS, &rlim);
    rlim.rlim_cur = rlim.rlim_max = 32 << 20;
    setrlimit(RLIMIT_MEMLOCK, &rlim);
    rlim.rlim_cur = rlim.rlim_max = 136 << 20;
    setrlimit(RLIMIT_FSIZE, &rlim);
    rlim.rlim_cur = rlim.rlim_max = 1 << 20;
    setrlimit(RLIMIT_STACK, &rlim);
    rlim.rlim_cur = rlim.rlim_max = 128 << 20;
    setrlimit(RLIMIT_CORE, &rlim);
    rlim.rlim_cur = rlim.rlim_max = 256;
    setrlimit(RLIMIT_NOFILE, &rlim);
    if (unshare(CLONE_NEWNS)) {
    }
    if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL)) {
    }
    if (unshare(CLONE_NEWIPC)) {
    }
    if (unshare(0x02000000)) {
    }
    if (unshare(CLONE_NEWUTS)) {
    }
    if (unshare(CLONE_SYSVSEM)) {
    }
    typedef struct {
        const char* name;
        const char* value;
    } sysctl_t;
    static const sysctl_t sysctls[] = {
        {"/proc/sys/kernel/shmmax", "16777216"},
        {"/proc/sys/kernel/shmall", "536870912"},
        {"/proc/sys/kernel/shmmni", "1024"},
        {"/proc/sys/kernel/msgmax", "8192"},
        {"/proc/sys/kernel/msgmni", "1024"},
        {"/proc/sys/kernel/msgmnb", "1024"},
        {"/proc/sys/kernel/sem", "1024 1048576 500 1024"},
    };
    unsigned i;
    for (i = 0; i < sizeof(sysctls) / sizeof(sysctls[0]); i++)
        write_file(sysctls[i].name, sysctls[i].value);
}

static int wait_for_loop(int pid)
{
    if (pid < 0)
    exit(1);
    int status = 0;
    while (waitpid(-1, &status, __WALL) != pid) {
    }
    return WEXITSTATUS(status);
}

static void drop_caps(void)
{
    struct __user_cap_header_struct cap_hdr = {};
    struct __user_cap_data_struct cap_data[2] = {};
    cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
    cap_hdr.pid = getpid();
    if (syscall(SYS_capget, &cap_hdr, &cap_data))
    exit(1);
    const int drop = (1 << CAP_SYS_PTRACE) | (1 << CAP_SYS_NICE);
    cap_data[0].effective &= ~drop;
    cap_data[0].permitted &= ~drop;
    cap_data[0].inheritable &= ~drop;
    if (syscall(SYS_capset, &cap_hdr, &cap_data))
    exit(1);
}

static int do_sandbox_none(void)
{
    if (unshare(CLONE_NEWPID)) {
    }
    int pid = fork();
    if (pid != 0)
        return wait_for_loop(pid);
    sandbox_common();
    drop_caps();
    if (unshare(CLONE_NEWNET)) {
    }
    write_file("/proc/sys/net/ipv4/ping_group_range", "0 65535");
    sandbox_common_mount_tmpfs();
    loop();
    exit(1);
}

#define USLEEP_FORKED_CHILD (3 * 50 *1000)

static long handle_clone_ret(long ret)
{
    if (ret != 0) {
        return ret;
    }
    usleep(USLEEP_FORKED_CHILD);
    syscall(__NR_exit, 0);
    while (1) {
    }
}

static long syz_clone(volatile long flags, volatile long stack,
              volatile long stack_len, volatile long ptid,
              volatile long ctid, volatile long tls)
{
    long sp = (stack + stack_len) & ~15;
    long ret = (long)syscall(__NR_clone, flags & ~CLONE_VM, sp, ptid,
ctid, tls);
    return handle_clone_ret(ret);
}

void loop(void)
{
    if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
    syz_clone(0x1004580, 0, 0, 0, 0, 0);
}

int main(void)
{
    syscall(__NR_mmap, 0x1ffffffff000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
    syscall(__NR_mmap, 0x200000000000ul, 0x1000000ul, 7ul, 0x32ul, -1, 0ul);
    syscall(__NR_mmap, 0x200001000000ul, 0x1000ul, 0ul, 0x32ul, -1, 0ul);
    do_sandbox_none();
    return 0;
}
---

To reproduce:
  $ gcc -static -o repro repro.c -lpthread
  # run inside a VM or container with the affected kernel
  $ ./repro

Thanks.