-
Notifications
You must be signed in to change notification settings - Fork 475
Description
Hi,
While testing on modern Linux kernels (v5.12 and later), I encountered a regression where hiding a process via the SIGINVIS (31) signal causes the target process to immediately crash with SIGSYS (Bad system call) and a core dump.
Issue
The issue appears to be a bitmask collision within the task_struct->flags field.
In diamorphine.h, the project defines its visibility flag as:
#define PF_INVISIBLE 0x10000000
However, as of Linux Kernel v5.12, the upstream kernel introduced PF_IO_WORKER using the exact same bit:
#define PF_IO_WORKER 0x10000000
More specifically the version i tested on v5.15.0 had #define PF_MEMALLOC_PIN 0x100000000
The Conflict
When Diamorphine toggles this bit on a standard user process at line 340 of diamorphine.c, the kernel's scheduler and syscall entry code begin treating that process as an internal io_uring worker. Because the process is not actually a kernel-managed worker thread, the kernel identifies an inconsistent internal state and terminates the process with SIGSYS to prevent further corruption or in other words the flag conflicts with an official kernel flag
Possible workaround
To maintain compatibility with modern kernels i recommend changing PF_INVISIBLE to a bit that is currently unassigned in the task_struct->flags bitmask. Moving this definition in diamorphine.h to an unused bit (for example, 0x00001000 or similar, depending on the target kernel's sched.h) should fix the crashes, however the design itself may not hold as task_struct->flag can no longer be used as a reliable namespace in modern kernels.
Thank you for your time and for this great project!