OS-3794: lxbrand panic on init signal death


Issue Type:Bug
Priority:4 - Normal
Created at:2015-02-04T01:08:52.000Z
Updated at:2019-08-29T01:04:00.832Z


Created by:Former user
Reported by:Former user
Assigned to:Former user


Fixed: A fix for this issue is checked into the tree and tested.
(Resolution Date: 2015-02-13T01:43:54.000Z)

Fix Versions

2015-02-19 Itanium (Release Date: 2015-02-19)




You can, it seems, induce a panic from an LX zone by causing the LX-branded init process to die on a signal. The panic stack looks like:

fffffffffbc7bca0 kmdb_enter+0xb()
fffffffffbc7bcd0 debug_enter+0x5d(fffffffffb9324d0)
fffffffffbc7bdb0 panicsys+0x5b9(fffffffffb92b91f, ffffff00056eec20,
fffffffffbc7bdc0, 1)
ffffff00056eec10 vpanic+0x15c()
ffffff00056eec80 param_preset()
ffffff00056eeca0 mutex_panic+0x58(fffffffffb92b93c, ffffff0147a32dc0)
ffffff00056eed10 mutex_vector_enter+0x2b7(ffffff0147a32dc0)
ffffff00056eed50 killall+0x7c(1, 0)
ffffff00056eedb0 zone_kadmin+0xf3(1, 0, 0, ffffff0150e3d020)
ffffff00056eedf0 lx_brand`lx_proc_exit+0xc5(ffffff0150e67048, ffffff014a409cc0)
ffffff00056eee20 brand_clearbrand+0x3e(ffffff0150e67048, 0)
ffffff00056eeec0 proc_exit+0x11a(1, b)
ffffff00056eeee0 exit+0x15(1, b)
ffffff00056eef00 rexit+0x18(b)
ffffff00056eef10 sys_syscall+0x17a()

This is induced by lx_proc_exit calling into zone_kadmin while holding the current process lock. The current process is, apparently, not yet exited enough to be ignored by the subsequent killall call and it tries to re-take our lock.

Trivially altering our routine to drop p_lock while calling zone_kadmin is unhelpful; we end up re-entering exit and fail to remove the brand thread context operations for a second time.

If the reboot behaviour is removed altogether, though it does not do what we want from a Linux perspective (i.e. init death causes a kernel panic!!!) it also does not panic the machine.


Comment by Former user
Created at 2015-02-13T01:32:51.000Z

illumos-joyent commit 200c7a6 (branch master, by Joshua M. Clulow)

OS-3820 lxbrand ptrace(2): the next generation
OS-3685 lxbrand PTRACE_O_TRACEFORK race condition
OS-3834 lxbrand 64-bit strace(1) reports 64-bit process as using x32 ABI
OS-3794 lxbrand panic on init signal death
Reviewed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: Jerry Jelinek <jerry.jelinek@joyent.com>
Reviewed by: Bryan Cantrill <bryan@joyent.com>