diff options
| author | Oleg Nesterov <oleg@redhat.com> | 2009-04-14 01:40:03 +0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-04-14 02:04:31 +0400 |
| commit | f1671f6d783a2385d32e11f456cbe32f0e4b4b49 (patch) | |
| tree | 3d2dd4672db69b9d3b7f35e06b0fb90ca4d8cc12 /kernel/ptrace.c | |
| parent | 7b102d034c0affc6ee703b576f2496ec6cb81d79 (diff) | |
| download | linux-f1671f6d783a2385d32e11f456cbe32f0e4b4b49.tar.xz | |
ptrace: fix exit_ptrace() vs ptrace_traceme() race
Pointed out by Roland. The bug was recently introduced by me in
"forget_original_parent: split out the un-ptrace part", commit
39c626ae47c469abdfd30c6e42eff884931380d6.
Since that patch we have a window after exit_ptrace() drops tasklist and
before forget_original_parent() takes it again. In this window the child
can do ptrace(PTRACE_TRACEME) and nobody can untrace this child after
that.
Change ptrace_traceme() to not attach to the exiting ->real_parent. We
don't report the error in this case, we pretend we attach right before
->real_parent calls exit_ptrace() which should untrace us anyway.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel/ptrace.c')
| -rw-r--r-- | kernel/ptrace.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/kernel/ptrace.c b/kernel/ptrace.c index 64191fa09b7e..dfcd83ceee3b 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -604,10 +604,11 @@ repeat: ret = security_ptrace_traceme(current->parent); /* - * Set the ptrace bit in the process ptrace flags. - * Then link us on our parent's ptraced list. + * Check PF_EXITING to ensure ->real_parent has not passed + * exit_ptrace(). Otherwise we don't report the error but + * pretend ->real_parent untraces us right after return. */ - if (!ret) { + if (!ret && !(current->real_parent->flags & PF_EXITING)) { current->ptrace |= PT_PTRACED; __ptrace_link(current, current->real_parent); } |