Messages in this thread | | | Date | Mon, 9 Feb 2009 02:28:24 +0100 | From | Oleg Nesterov <> | Subject | Re: [PATCH, for 2.6.29] ptrace: fix the usage of ptrace_fork() |
| |
On 02/09, Oleg Nesterov wrote: > > I noticed by pure accident we have ptrace_fork() and friends. This was > added by "x86, bts: add fork and exit handling", commit > bf53de907dfdaac178c92d774aae7370d7b97d20
Hmm. Looks like we have more problems here...
"x86, bts: memory accounting", commit c5dee6177f4bd2095aab7d9be9f6ebdddd6deee9.
PTRACE_BTS_CONFIG allocates ->bts_buffer via alloc_locked_buffer() which updates mm->total_vm/locked_vm.
ptrace_detach() does free_locked_buffer() which "restores" mm->xxx_vm.
But if the tracer exits we are doing __ptrace_unlink()->ptrace_bts_untrace() which uses a plain kfree(), in that case we don't update mm->xxx_vm ?
Note that the exiting tracer can have sub-threads, so the whole process does not necessary dies.
Or, the tracer can reap a zombie tracee without PTRACE_DETACH, in that case we don't update ->mm too.
Oh, and afaics ptrace_detach()->ptrace_bts_detach() can race with the tracer's sub-thread which does do_wait()->release_task() (if the tracee was killed before detach takes tasklist), the kernel can crash in this case.
Unless I missed something, This all looks rather wrong, and I wasn't aware about these changes :(
Oleg.
| |