lkml.org 
[lkml]   [2009]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 66/87] ptrace: fix possible zombie leak on PTRACE_DETACH
    2.6.29-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Oleg Nesterov <oleg@redhat.com>

    commit 4576145c1ecdaaea9ef8976a48335206aa1ebf91 upstream.

    When ptrace_detach() takes tasklist, the tracee can be SIGKILL'ed. If it
    has already passed exit_notify() we can leak a zombie, because a) ptracing
    disables the auto-reaping logic, and b) ->real_parent was not notified
    about the child's death.

    ptrace_detach() should follow the ptrace_exit's logic, change the code
    accordingly.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Cc: Jerome Marchand <jmarchan@redhat.com>
    Cc: Roland McGrath <roland@redhat.com>
    Tested-by: Denys Vlasenko <dvlasenk@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    include/linux/ptrace.h | 1 +
    kernel/ptrace.c | 9 +++++++--
    2 files changed, 8 insertions(+), 2 deletions(-)

    --- a/include/linux/ptrace.h
    +++ b/include/linux/ptrace.h
    @@ -94,6 +94,7 @@ extern void ptrace_notify(int exit_code)
    extern void __ptrace_link(struct task_struct *child,
    struct task_struct *new_parent);
    extern void __ptrace_unlink(struct task_struct *child);
    +extern int __ptrace_detach(struct task_struct *tracer, struct task_struct *p);
    extern void ptrace_fork(struct task_struct *task, unsigned long clone_flags);
    #define PTRACE_MODE_READ 1
    #define PTRACE_MODE_ATTACH 2
    --- a/kernel/ptrace.c
    +++ b/kernel/ptrace.c
    @@ -237,6 +237,8 @@ out:

    int ptrace_detach(struct task_struct *child, unsigned int data)
    {
    + int dead = 0;
    +
    if (!valid_signal(data))
    return -EIO;

    @@ -244,18 +246,21 @@ int ptrace_detach(struct task_struct *ch
    ptrace_disable(child);
    clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);

    - /* protect against de_thread()->release_task() */
    write_lock_irq(&tasklist_lock);
    + /* protect against de_thread()->release_task() */
    if (child->ptrace) {
    child->exit_code = data;

    - __ptrace_unlink(child);
    + dead = __ptrace_detach(current, child);

    if (!child->exit_state)
    wake_up_process(child);
    }
    write_unlock_irq(&tasklist_lock);

    + if (unlikely(dead))
    + release_task(child);
    +
    return 0;
    }




    \
     
     \ /
      Last update: 2009-06-09 12:45    [W:0.045 / U:63.032 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site