And that’s how I found the issue: my custom kernel module showed the stack traces from the places where the __state field of task_struct was being written to. I’ve noticed an outlier which revealed a buffer overflow in ptrace_put_fpr (used by the POKEUSER API). This led to important fields from task_struct getting overwritten, such as __state, which stores the state of the process and it’s also used by the kernel to keep track of which processes are stopped by the debugger.

#linux #programming #systems