lkml.org 
[lkml]   [2009]   [Mar]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH] copy_process: fix CLONE_PARENT && parent_exec_id interaction
On 03/02, Linus Torvalds wrote:
>
>
> On Mon, 2 Mar 2009, Oleg Nesterov wrote:
> >
> > I am re-sending this patch simplified to one-liner. If this patch is
> > accepted, I think it makes sense to move the first
> > "p->parent_exec_id = p->self_exec_id" in copy_process() down, under
> > the "else" branch. Just for readability.
> >
> > Note! This patch doesn't even try to address the original CVE. Let me
> > repeat, I am not the security expert, please correct me. But, unless
> > parent or child change security context (via exec), it is OK to send
> > any ->exit_signal when the child exits.
> >
> > Comments?
>
> I think this looks correct and sane. And I agree with your "also move down
> the "p->parent_exec_id = p->self_exec_id" thing. In fact, I'd agree with
> it so much that I think it should be part of this patch, just because that
> not only clarifies the code, but it also makes it more obvious what the
> real change of this one single _patch_ is.

Agreed, please find v2 below. But I failed to make the comment...

Also, "p->parent_exec_id = current->parent_exec_id" is not really needed
in v2, it was already copied by dup_task_struct(). But I think it is better
to make the code a bit more explicit.

------------------
[PATCH v2] copy_process: fix CLONE_PARENT && parent_exec_id interaction

CLONE_PARENT can fool the ->self_exec_id/parent_exec_id logic. If we
re-use the old parent, we must also re-use ->parent_exec_id to make
sure exit_notify() sees the right ->xxx_exec_id's when the CLONE_PARENT'ed
task exits.

Also, move down the "p->parent_exec_id = p->self_exec_id" thing, to place
two different cases together.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>

--- 6.29-rc3/kernel/fork.c~3_CLONE_PARENT 2009-03-02 20:24:59.000000000 +0100
+++ 6.29-rc3/kernel/fork.c 2009-03-02 22:38:39.000000000 +0100
@@ -1177,10 +1177,6 @@ static struct task_struct *copy_process(
#endif
clear_all_latency_tracing(p);

- /* Our parent execution domain becomes current domain
- These must match for thread signalling to apply */
- p->parent_exec_id = p->self_exec_id;
-
/* ok, now we should be set up.. */
p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
p->pdeath_signal = 0;
@@ -1218,10 +1214,13 @@ static struct task_struct *copy_process(
set_task_cpu(p, smp_processor_id());

/* CLONE_PARENT re-uses the old parent */
- if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+ if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
p->real_parent = current->real_parent;
- else
+ p->parent_exec_id = current->parent_exec_id;
+ } else {
p->real_parent = current;
+ p->parent_exec_id = current->self_exec_id;
+ }

spin_lock(&current->sighand->siglock);



\
 
 \ /
  Last update: 2009-03-02 23:05    [W:0.092 / U:0.328 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site