Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b79b7ba9 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

ptrace: ptrace_attach: check PF_KTHREAD + exit_state instead of ->mm 



- Add PF_KTHREAD check to prevent attaching to the kernel thread
  with a borrowed ->mm.

  With or without this change we can race with daemonize() which
  can set PF_KTHREAD or clear ->mm after ptrace_attach() does the
  check, but this doesn't matter because reparent_to_kthreadd()
  does ptrace_unlink().

- Kill "!task->mm" check. We don't really care about ->mm != NULL,
  and the task can call exit_mm() right after we drop task_lock().
  What we need is to make sure we can't attach after exit_notify(),
  check task->exit_state != 0 instead.

Also, move the "already traced" check down for cosmetic reasons.

Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
Cc: Chris Wright <chrisw@sous-sol.org>
Acked-by: default avatarRoland McGrath <roland@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5cb11446

kernel/ptrace.c

+10 −9
Original line number Diff line number Diff line
@@ -172,6 +172,8 @@ int ptrace_attach(struct task_struct *task) 
	audit_ptrace(task);



	retval = -EPERM;

	if (unlikely(task->flags & PF_KTHREAD))

		goto out;

	if (same_thread_group(task, current))

		goto out;
@@ -182,8 +184,6 @@ int ptrace_attach(struct task_struct *task) 
	retval = mutex_lock_interruptible(&task->cred_guard_mutex);

	if (retval  < 0)

		goto out;



	retval = -EPERM;

repeat:

	/*

	 * Nasty, nasty.
@@ -203,23 +203,24 @@ repeat: 
		goto repeat;

	}



	if (!task->mm)

		goto bad;

	/* the same process cannot be attached many times */

	if (task->ptrace & PT_PTRACED)

		goto bad;

	retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);

	if (retval)

		goto bad;



	/* Go */

	retval = -EPERM;

	if (unlikely(task->exit_state))

		goto bad;

	if (task->ptrace & PT_PTRACED)

		goto bad;



	task->ptrace |= PT_PTRACED;

	if (capable(CAP_SYS_PTRACE))

		task->ptrace |= PT_PTRACE_CAP;



	__ptrace_link(task, current);



	send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);



	retval = 0;

bad:

	write_unlock_irqrestore(&tasklist_lock, flags);

	task_unlock(task);