Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bf26c018 authored by Frederic Weisbecker's avatar Frederic Weisbecker
Browse files

ptrace: Prepare to fix racy accesses on task breakpoints 



When a task is traced and is in a stopped state, the tracer
may execute a ptrace request to examine the tracee state and
get its task struct. Right after, the tracee can be killed
and thus its breakpoints released.
This can happen concurrently when the tracer is in the middle
of reading or modifying these breakpoints, leading to dereferencing
a freed pointer.

Hence, to prepare the fix, create a generic breakpoint reference
holding API. When a reference on the breakpoints of a task is
held, the breakpoints won't be released until the last reference
is dropped. After that, no more ptrace request on the task's
breakpoints can be serviced for the tracer.

Reported-by: default avatarOleg Nesterov <oleg@redhat.com>
Signed-off-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Prasad <prasad@linux.vnet.ibm.com>
Cc: Paul Mundt <lethal@linux-sh.org>
Cc: v2.6.33.. <stable@kernel.org>
Link: http://lkml.kernel.org/r/1302284067-7860-2-git-send-email-fweisbec@gmail.com
parent f4929bd3

include/linux/ptrace.h

+12 −1
Original line number Diff line number Diff line
@@ -189,6 +189,10 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace) 
		child->ptrace = current->ptrace;

		__ptrace_link(child, current->parent);

	}



#ifdef CONFIG_HAVE_HW_BREAKPOINT

	atomic_set(&child->ptrace_bp_refcnt, 1);

#endif

}



/**
@@ -350,6 +354,13 @@ extern int task_current_syscall(struct task_struct *target, long *callno, 
				unsigned long args[6], unsigned int maxargs,

				unsigned long *sp, unsigned long *pc);



#endif

#ifdef CONFIG_HAVE_HW_BREAKPOINT

extern int ptrace_get_breakpoints(struct task_struct *tsk);

extern void ptrace_put_breakpoints(struct task_struct *tsk);

#else

static inline void ptrace_put_breakpoints(struct task_struct *tsk) { }

#endif /* CONFIG_HAVE_HW_BREAKPOINT */



#endif /* __KERNEL */



#endif

include/linux/sched.h

+3 −0
Original line number Diff line number Diff line
@@ -1537,6 +1537,9 @@ struct task_struct { 
		unsigned long memsw_nr_pages; /* uncharged mem+swap usage */

	} memcg_batch;

#endif

#ifdef CONFIG_HAVE_HW_BREAKPOINT

	atomic_t ptrace_bp_refcnt;

#endif

};



/* Future-safe accessor for struct task_struct's cpus_allowed. */

kernel/exit.c

+1 −1
Original line number Diff line number Diff line
@@ -1016,7 +1016,7 @@ NORET_TYPE void do_exit(long code) 
	/*

	 * FIXME: do that only when needed, using sched_exit tracepoint

	 */

	flush_ptrace_hw_breakpoint(tsk);

	ptrace_put_breakpoints(tsk);



	exit_notify(tsk, group_dead);

#ifdef CONFIG_NUMA

kernel/ptrace.c

+17 −0
Original line number Diff line number Diff line
@@ -22,6 +22,7 @@ 
#include <linux/syscalls.h>

#include <linux/uaccess.h>

#include <linux/regset.h>

#include <linux/hw_breakpoint.h>





/*
@@ -879,3 +880,19 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid, 
	return ret;

}

#endif	/* CONFIG_COMPAT */



#ifdef CONFIG_HAVE_HW_BREAKPOINT

int ptrace_get_breakpoints(struct task_struct *tsk)

{

	if (atomic_inc_not_zero(&tsk->ptrace_bp_refcnt))

		return 0;



	return -1;

}



void ptrace_put_breakpoints(struct task_struct *tsk)

{

	if (atomic_dec_and_test(&tsk->ptrace_bp_refcnt))

		flush_ptrace_hw_breakpoint(tsk);

}

#endif /* CONFIG_HAVE_HW_BREAKPOINT */