Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f5b40e36 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Fix ptrace_attach()/ptrace_traceme()/de_thread() race 



This holds the task lock (and, for ptrace_attach, the tasklist_lock)
over the actual attach event, which closes a race between attacking to a
thread that is either doing a PTRACE_TRACEME or getting de-threaded.

Thanks to Oleg Nesterov for reminding me about this, and Chris Wright
for noticing a lost return value in my first version.

Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 5528e568

kernel/ptrace.c

+21 −18
Original line number Diff line number Diff line
@@ -148,12 +148,16 @@ int ptrace_may_attach(struct task_struct *task) 
int ptrace_attach(struct task_struct *task)

{

	int retval;

	task_lock(task);



	retval = -EPERM;

	if (task->pid <= 1)

		goto bad;

		goto out;

	if (task->tgid == current->tgid)

		goto bad;

		goto out;



	write_lock_irq(&tasklist_lock);

	task_lock(task);



	/* the same process cannot be attached many times */

	if (task->ptrace & PT_PTRACED)

		goto bad;
@@ -166,17 +170,15 @@ int ptrace_attach(struct task_struct *task) 
				      ? PT_ATTACHED : 0);

	if (capable(CAP_SYS_PTRACE))

		task->ptrace |= PT_PTRACE_CAP;

	task_unlock(task);



	write_lock_irq(&tasklist_lock);

	__ptrace_link(task, current);

	write_unlock_irq(&tasklist_lock);



	force_sig_specific(SIGSTOP, task);

	return 0;



bad:

	write_unlock_irq(&tasklist_lock);

	task_unlock(task);

out:

	return retval;

}
@@ -417,21 +419,22 @@ int ptrace_request(struct task_struct *child, long request, 
 */

int ptrace_traceme(void)

{

	int ret;

	int ret = -EPERM;



	/*

	 * Are we already being traced?

	 */

	if (current->ptrace & PT_PTRACED)

		return -EPERM;

	task_lock(current);

	if (!(current->ptrace & PT_PTRACED)) {

		ret = security_ptrace(current->parent, current);

	if (ret)

		return -EPERM;

		/*

		 * Set the ptrace bit in the process ptrace flags.

		 */

		if (!ret)

			current->ptrace |= PT_PTRACED;

	return 0;

	}

	task_unlock(current);

	return ret;

}



/**