Skip to content

Hiding a process via the SIGINVIS (31) signal causes the target process to immediately crash. #53

@rootfragment

Description

@rootfragment

Hi,
While testing on modern Linux kernels (v5.12 and later), I encountered a regression where hiding a process via the SIGINVIS (31) signal causes the target process to immediately crash with SIGSYS (Bad system call) and a core dump.

Issue

The issue appears to be a bitmask collision within the task_struct->flags field.

In diamorphine.h, the project defines its visibility flag as:
#define PF_INVISIBLE 0x10000000

However, as of Linux Kernel v5.12, the upstream kernel introduced PF_IO_WORKER using the exact same bit:
#define PF_IO_WORKER 0x10000000
More specifically the version i tested on v5.15.0 had #define PF_MEMALLOC_PIN 0x100000000

The Conflict

When Diamorphine toggles this bit on a standard user process at line 340 of diamorphine.c, the kernel's scheduler and syscall entry code begin treating that process as an internal io_uring worker. Because the process is not actually a kernel-managed worker thread, the kernel identifies an inconsistent internal state and terminates the process with SIGSYS to prevent further corruption or in other words the flag conflicts with an official kernel flag

Possible workaround

To maintain compatibility with modern kernels i recommend changing PF_INVISIBLE to a bit that is currently unassigned in the task_struct->flags bitmask. Moving this definition in diamorphine.h to an unused bit (for example, 0x00001000 or similar, depending on the target kernel's sched.h) should fix the crashes, however the design itself may not hold as task_struct->flag can no longer be used as a reliable namespace in modern kernels.

Thank you for your time and for this great project!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions