lkml.org 
[lkml]   [2017]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 195/204] ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock
    3.16.52-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Oleg Nesterov <oleg@redhat.com>

    commit 1333ab03150478df8d6f5673a91df1e50dc6ab97 upstream.

    This test-case (simplified version of generated by syzkaller)

    #include <unistd.h>
    #include <sys/ptrace.h>
    #include <sys/wait.h>

    void test(void)
    {
    for (;;) {
    if (fork()) {
    wait(NULL);
    continue;
    }

    ptrace(PTRACE_SEIZE, getppid(), 0, 0);
    ptrace(PTRACE_INTERRUPT, getppid(), 0, 0);
    _exit(0);
    }
    }

    int main(void)
    {
    int np;

    for (np = 0; np < 8; ++np)
    if (!fork())
    test();

    while (wait(NULL) > 0)
    ;
    return 0;
    }

    triggers the 2nd WARN_ON_ONCE(!signr) warning in do_jobctl_trap(). The
    problem is that __ptrace_unlink() clears task->jobctl under siglock but
    task->ptrace is cleared without this lock held; this fools the "else"
    branch which assumes that !PT_SEIZED means PT_PTRACED.

    Note also that most of other PTRACE_SEIZE checks can race with detach
    from the exiting tracer too. Say, the callers of ptrace_trap_notify()
    assume that SEIZED can't go away after it was checked.

    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Reported-by: Dmitry Vyukov <dvyukov@google.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: syzkaller <syzkaller@googlegroups.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    kernel/ptrace.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/kernel/ptrace.c
    +++ b/kernel/ptrace.c
    @@ -79,12 +79,11 @@ void __ptrace_unlink(struct task_struct
    {
    BUG_ON(!child->ptrace);

    - child->ptrace = 0;
    child->parent = child->real_parent;
    list_del_init(&child->ptrace_entry);

    spin_lock(&child->sighand->siglock);
    -
    + child->ptrace = 0;
    /*
    * Clear all pending traps and TRAPPING. TRAPPING should be
    * cleared regardless of JOBCTL_STOP_PENDING. Do it explicitly.
    \
     
     \ /
      Last update: 2017-12-28 18:19    [W:4.344 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site