Messages in this thread Patch in this message | | | From | bsegall@google ... | Subject | [PATCH] ptrace: fix PTRACE_LISTEN race corrupting task->state | Date | Tue, 21 Feb 2017 10:47:54 -0800 |
| |
In PT_SEIZED + LISTEN mode SIGSTOP/SIGCONT signals cause a wakeup against __TASK_TRACED. If this races with the ptrace_unfreeze_traced at the end of a PTRACE_LISTEN, this can wake the task /after/ the check against __TASK_TRACED, but before the reset of state to TASK_TRACED. This causes it to instead clobber TASK_WAKING, allowing a subsequent wakeup against TASK_TRACED while the task is still on the rq wake_list, corrupting it.
Signed-off-by: Ben Segall <bsegall@google.com> --- kernel/ptrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/ptrace.c b/kernel/ptrace.c index 0af928712174..852d71440ded 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -184,10 +184,14 @@ static void ptrace_unfreeze_traced(struct task_struct *task) WARN_ON(!task->ptrace || task->parent != current); + /* + * Double check __TASK_TRACED under the lock to prevent corrupting state + * in case of a ptrace_trap_notify wakeup + */ spin_lock_irq(&task->sighand->siglock); if (__fatal_signal_pending(task)) wake_up_state(task, __TASK_TRACED); - else + else if (task->state == __TASK_TRACED) task->state = TASK_TRACED; spin_unlock_irq(&task->sighand->siglock); } -- 2.11.0.483.g087da7b7c-goog
| |