Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5ecfbae0 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

[PATCH] fix zap_thread's ptrace related problems 



1. The tracee can go from ptrace_stop() to do_signal_stop()
   after __ptrace_unlink(p).

2. It is unsafe to __ptrace_unlink(p) while p->parent may wait
   for tasklist_lock in ptrace_detach().

Signed-off-by: default avatarOleg Nesterov <oleg@tv-sign.ru>
Cc: Roland McGrath <roland@redhat.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent dadac81b

fs/exec.c

+1 −1
Original line number Diff line number Diff line
@@ -1403,7 +1403,7 @@ static void zap_threads (struct mm_struct *mm) 
		do_each_thread(g,p) {

			if (mm == p->mm && p != tsk &&

			    p->ptrace && p->parent->mm == mm) {

				__ptrace_unlink(p);

				__ptrace_detach(p, 0);

			}

		} while_each_thread(g,p);

		write_unlock_irq(&tasklist_lock);

include/linux/ptrace.h

+1 −0
Original line number Diff line number Diff line
@@ -84,6 +84,7 @@ extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __us 
extern int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len);

extern int ptrace_attach(struct task_struct *tsk);

extern int ptrace_detach(struct task_struct *, unsigned int);

extern void __ptrace_detach(struct task_struct *, unsigned int);

extern void ptrace_disable(struct task_struct *);

extern int ptrace_check_attach(struct task_struct *task, int kill);

extern int ptrace_request(struct task_struct *child, long request, long addr, long data);

kernel/ptrace.c

+15 −10
Original line number Diff line number Diff line
@@ -72,8 +72,8 @@ void ptrace_untrace(task_t *child) 
 */

void __ptrace_unlink(task_t *child)

{

	if (!child->ptrace)

		BUG();

	BUG_ON(!child->ptrace);



	child->ptrace = 0;

	if (!list_empty(&child->ptrace_list)) {

		list_del_init(&child->ptrace_list);
@@ -184,6 +184,16 @@ int ptrace_attach(struct task_struct *task) 
	return retval;

}



void __ptrace_detach(struct task_struct *child, unsigned int data)

{

	child->exit_code = data;

	/* .. re-parent .. */

	__ptrace_unlink(child);

	/* .. and wake it up. */

	if (child->exit_state != EXIT_ZOMBIE)

		wake_up_process(child);

}



int ptrace_detach(struct task_struct *child, unsigned int data)

{

	if (!valid_signal(data))
@@ -192,14 +202,9 @@ int ptrace_detach(struct task_struct *child, unsigned int data) 
	/* Architecture-specific hardware disable .. */

	ptrace_disable(child);



	/* .. re-parent .. */

	child->exit_code = data;



	write_lock_irq(&tasklist_lock);

	__ptrace_unlink(child);

	/* .. and wake it up. */

	if (child->exit_state != EXIT_ZOMBIE)

		wake_up_process(child);

	if (child->ptrace)

		__ptrace_detach(child, data);

	write_unlock_irq(&tasklist_lock);



	return 0;