[merged] ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock.patch removed from -mm tree

[akpm@xxxxxxxxxxxxxxxxxxxx]

The patch titled
     Subject: ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock
has been removed from the -mm tree.  Its filename was
     ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Oleg Nesterov <oleg@xxxxxxxxxx>
Subject: ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock

This test-case (simplified version of generated by syzkaller)

	#include <unistd.h>
	#include <sys/ptrace.h>
	#include <sys/wait.h>

	void test(void)
	{
		for (;;) {
			if (fork()) {
				wait(NULL);
				continue;
			}

			ptrace(PTRACE_SEIZE, getppid(), 0, 0);
			ptrace(PTRACE_INTERRUPT, getppid(), 0, 0);
			_exit(0);
		}
	}

	int main(void)
	{
		int np;

		for (np = 0; np < 8; ++np)
			if (!fork())
				test();

		while (wait(NULL) > 0)
			;
		return 0;
	}

triggers the 2nd WARN_ON_ONCE(!signr) warning in do_jobctl_trap(). The problem
is that __ptrace_unlink() clears task->jobctl under siglock but task->ptrace
is cleared without this lock held; this fools the "else" branch which assumes
that !PT_SEIZED means PT_PTRACED.

Note also that most of other PTRACE_SEIZE checks can race with detach from the
exiting tracer too. Say, the callers of ptrace_trap_notify() assume that SEIZED
can't go away after it was checked.

Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Tejun Heo <tj@xxxxxxxxxx>
Cc: syzkaller <syzkaller@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---

 kernel/ptrace.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff -puN kernel/ptrace.c~ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock kernel/ptrace.c
--- a/kernel/ptrace.c~ptrace-change-__ptrace_unlink-to-clear-ptrace-under-siglock
+++ a/kernel/ptrace.c
@@ -73,12 +73,11 @@ void __ptrace_unlink(struct task_struct
 {
 	BUG_ON(!child->ptrace);
 
-	child->ptrace = 0;
 	child->parent = child->real_parent;
 	list_del_init(&child->ptrace_entry);
 
 	spin_lock(&child->sighand->siglock);
-
+	child->ptrace = 0;
 	/*
 	 * Clear all pending traps and TRAPPING.  TRAPPING should be
 	 * cleared regardless of JOBCTL_STOP_PENDING.  Do it explicitly.
_

Patches currently in -mm which might be from oleg@xxxxxxxxxx are


--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html