MIPS has 128 signals, the highest of which has the number 128. The following command causes get_signal_to_deliver() to pass this signal number straight through to do_group_exit() as the exit code: strace sleep 10 & sleep 1 && kill -128 `pidof sleep` However do_group_exit() checks for the core dump bit (0x80) in the exit code which matches in this particular case and the kernel panics: BUG_ON(exit_code & 0x80); /* core dumps don't get here */ This is worked around by changing get_signal_to_deliver() to pass min(info->si_signo, 127) instead of info->si_signo, so that this highest of signal numbers get rounded down to 127. This makes the exit code technically incorrect, but it's better than killing the whole kernel. Signed-off-by: James Hogan <james.hogan@xxxxxxxxxx> Cc: Ralf Baechle <ralf@xxxxxxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Cc: Oleg Nesterov <oleg@xxxxxxxxxx> Cc: Kees Cook <keescook@xxxxxxxxxxxx> --- This is based on v3.10-rc3. It's a little hacky, but aside from reducing the number of signals to 127 to avoid this case (which isn't backwards compatible) I'm not sure what else can be done. Any comments? kernel/signal.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/signal.c b/kernel/signal.c index 113411b..69bc00f 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -2366,8 +2366,12 @@ relock: /* * Death signals, no core dump. + * + * MIPS has a signal number 128 which clashes with the core dump + * bit. If this was the signal we still want to report a valid + * exit code, so round it down to 127. */ - do_group_exit(info->si_signo); + do_group_exit(min(info->si_signo, 127)); /* NOTREACHED */ } spin_unlock_irq(&sighand->siglock); -- 1.8.1.2
