The following reproducer program (must be compiled with -O0
as gcc optimizes out the infinite recursion) crashes the kernel with this panic:
95.388 [#0 sigtest(35:35)]: copy_to_user(0x01300ff0, 0xc7c29cb0, 4) failed at V0x01300ff0
[sigtest(35:35)]: ASSERTION FAILED: result.is_success()
[sigtest(35:35)]: ../../Kernel/Thread.cpp:808 in void Kernel::push_value_on_user_stack(FlatPtr&, FlatPtr)
[sigtest(35:35)]: KERNEL PANIC! :^(
[sigtest(35:35)]: Aborted
[sigtest(35:35)]: at ../../Kernel/Arch/x86/common/CPU.cpp:35 in void abort()
[sigtest(35:35)]: Kernel + 0x007c9726 Kernel::__panic(char const*, unsigned int, char const*) +0x115
[sigtest(35:35)]: Kernel + 0x0099082d abort.localalias +0x244
[sigtest(35:35)]: Kernel + 0x009905e9 abort.localalias +0x0
[sigtest(35:35)]: Kernel + 0x00937ec6 Kernel::push_value_on_user_stack(unsigned int&, unsigned int) +0x99
[sigtest(35:35)]: Kernel + 0x0093f6cd .L8448 +0x3f1
[sigtest(35:35)]: Kernel + 0x0093fc99 Kernel::Thread::send_urgent_signal_to_self(unsigned char) +0x95
[sigtest(35:35)]: Kernel + 0x00993157 page_fault_handler +0x690
[sigtest(35:35)]: Kernel + 0x0099090e page_fault_asm_entry +0x26
reproducer:
#include <signal.h>
#include <unistd.h>
void handler(int);
void handler(int)
{
write(2, "stack overflow\n", 15);
_exit(1);
}
unsigned infinite_recursion(unsigned x);
unsigned infinite_recursion(unsigned x) {
return infinite_recursion(x)+1;
}
int main()
{
struct sigaction sa = {
.sa_handler = handler,
.sa_mask = 0,
.sa_flags = 0,
};
sigfillset(&sa.sa_mask);
sigaction(SIGSEGV, &sa, 0);
infinite_recursion(0);
}
Pay now to fund the work behind this issue.
Get updates on progress being made.
Maintainer is rewarded once the issue is completed.
You're funding impactful open source efforts
You want to contribute to this effort
You want to get funding like this too