The patch titled
Subject: ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock
has been added to the -mm tree. Its filename is
ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Oleg Nesterov <oleg@xxxxxxxxxx>
Subject: ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock
This test-case (simplified version of generated by syzkaller)
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
void test(void)
{
for (;;) {
if (fork()) {
wait(NULL);
continue;
}
ptrace(PTRACE_SEIZE, getppid(), 0, 0);
ptrace(PTRACE_INTERRUPT, getppid(), 0, 0);
_exit(0);
}
}
int main(void)
{
int np;
for (np = 0; np < 8; ++np)
if (!fork())
test();
while (wait(NULL) > 0)
;
return 0;
}
triggers the 2nd WARN_ON_ONCE(!signr) warning in do_jobctl_trap(). The problem
is that __ptrace_unlink() clears task->jobctl under siglock but task->ptrace
is cleared without this lock held; this fools the "else" branch which assumes
that !PT_SEIZED means PT_PTRACED.
Note also that most of other PTRACE_SEIZE checks can race with detach from the
exiting tracer too. Say, the callers of ptrace_trap_notify() assume that SEIZED
can't go away after it was checked.
Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Tejun Heo <tj@xxxxxxxxxx>
Cc: syzkaller <syzkaller@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
kernel/ptrace.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff -puN kernel/ptrace.c~ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock kernel/ptrace.c
--- a/kernel/ptrace.c~ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock
+++ a/kernel/ptrace.c
@@ -73,12 +73,11 @@ void __ptrace_unlink(struct task_struct
{
BUG_ON(!child->ptrace);
- child->ptrace = 0;
child->parent = child->real_parent;
list_del_init(&child->ptrace_entry);
spin_lock(&child->sighand->siglock);
-
+ child->ptrace = 0;
/*
* Clear all pending traps and TRAPPING. TRAPPING should be
* cleared regardless of JOBCTL_STOP_PENDING. Do it explicitly.
_
Patches currently in -mm which might be from oleg@xxxxxxxxxx are
ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
