| From 4831f1ec303a1b694184e3ff53063546c1336a69 Mon Sep 17 00:00:00 2001 |
| From: Oleg Nesterov <oleg@redhat.com> |
| Date: Wed, 25 May 2011 19:20:21 +0200 |
| Subject: [PATCH] ptrace: ptrace_resume() shouldn't wake up !TASK_TRACED thread |
| |
| commit 0666fb51b1483f27506e212cc7f7b2645b5c7acc upstream. |
| |
| It is not clear why ptrace_resume() does wake_up_process(). Unless the |
| caller is PTRACE_KILL the tracee should be TASK_TRACED so we can use |
| wake_up_state(__TASK_TRACED). If sys_ptrace() races with SIGKILL we do |
| not need the extra and potentionally spurious wakeup. |
| |
| If the caller is PTRACE_KILL, wake_up_process() is even more wrong. |
| The tracee can sleep in any state in any place, and if we have a buggy |
| code which doesn't handle a spurious wakeup correctly PTRACE_KILL can |
| be used to exploit it. For example: |
| |
| int main(void) |
| { |
| int child, status; |
| |
| child = fork(); |
| if (!child) { |
| int ret; |
| |
| assert(ptrace(PTRACE_TRACEME, 0,0,0) == 0); |
| |
| ret = pause(); |
| printf("pause: %d %m\n", ret); |
| |
| return 0x23; |
| } |
| |
| sleep(1); |
| assert(ptrace(PTRACE_KILL, child, 0,0) == 0); |
| |
| assert(child == wait(&status)); |
| printf("wait: %x\n", status); |
| |
| return 0; |
| } |
| |
| prints "pause: -1 Unknown error 514", -ERESTARTNOHAND leaks to the |
| userland. In this case sys_pause() is buggy as well and should be |
| fixed. |
| |
| I do not know what was the original rationality behind PTRACE_KILL. |
| The man page is simply wrong and afaics it was always wrong. Imho |
| it should be deprecated, or may be it should do send_sig(SIGKILL) |
| as Denys suggests, but in any case I do not think that the current |
| behaviour was intentional. |
| |
| Note: there is another problem, ptrace_resume() changes ->exit_code |
| and this can race with SIGKILL too. Eventually we should change ptrace |
| to not use ->exit_code. |
| |
| Signed-off-by: Oleg Nesterov <oleg@redhat.com> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| kernel/ptrace.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/kernel/ptrace.c b/kernel/ptrace.c |
| index b7b491e6c25b..9450ec22e5a6 100644 |
| --- a/kernel/ptrace.c |
| +++ b/kernel/ptrace.c |
| @@ -507,7 +507,7 @@ static int ptrace_resume(struct task_struct *child, long request, long data) |
| } |
| |
| child->exit_code = data; |
| - wake_up_process(child); |
| + wake_up_state(child, __TASK_TRACED); |
| |
| return 0; |
| } |
| -- |
| 1.8.5.2 |
| |