Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit f1671f6d783a2385d32e11f456cbe32f0e4b4b49

Authored by Oleg Nesterov
Committed by Linus Torvalds
1 parent 7b102d034c
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

ptrace: fix exit_ptrace() vs ptrace_traceme() race 

Pointed out by Roland.  The bug was recently introduced by me in
"forget_original_parent: split out the un-ptrace part", commit
39c626ae47c469abdfd30c6e42eff884931380d6.

Since that patch we have a window after exit_ptrace() drops tasklist and
before forget_original_parent() takes it again.  In this window the child
can do ptrace(PTRACE_TRACEME) and nobody can untrace this child after
that.

Change ptrace_traceme() to not attach to the exiting ->real_parent.  We
don't report the error in this case, we pretend we attach right before
->real_parent calls exit_ptrace() which should untrace us anyway.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 4 additions and 3 deletions Side-by-side Diff

... ... @@ -604,10 +604,11 @@
604 604 ret = security_ptrace_traceme(current->parent);
605 605  
606 606 /*
607   - * Set the ptrace bit in the process ptrace flags.
608   - * Then link us on our parent's ptraced list.
  607 + * Check PF_EXITING to ensure ->real_parent has not passed
  608 + * exit_ptrace(). Otherwise we don't report the error but
  609 + * pretend ->real_parent untraces us right after return.
609 610 */
610   - if (!ret) {
  611 + if (!ret && !(current->real_parent->flags & PF_EXITING)) {
611 612 current->ptrace |= PT_PTRACED;
612 613 __ptrace_link(current, current->real_parent);
613 614 }