leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix ptrace_attach()/ptrace_traceme()/de_thread() race

Browse Source 
This holds the task lock (and, for ptrace_attach, the tasklist_lock)
over the actual attach event, which closes a race between attacking to a
thread that is either doing a PTRACE_TRACEME or getting de-threaded.

Thanks to Oleg Nesterov for reminding me about this, and Chris Wright
for noticing a lost return value in my first version.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Linus Torvalds 2006-05-07 10:49:33 -07:00
parent 5528e568a7
commit f5b40e363a
1 changed files with 21 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
kernel/ptrace.c
View File

@ -148,12 +148,16 @@ int ptrace_may_attach(struct task_struct *task)
int ptrace_attach(struct task_struct *task) int ptrace_attach(struct task_struct *task)
{ {
int retval; int retval;
task_lock(task);
retval = -EPERM; retval = -EPERM;
if (task->pid <= 1) if (task->pid <= 1)
goto bad; goto out;
if (task->tgid == current->tgid) if (task->tgid == current->tgid)
goto bad; goto out;
write_lock_irq(&tasklist_lock);
task_lock(task);
/* the same process cannot be attached many times */ /* the same process cannot be attached many times */
if (task->ptrace & PT_PTRACED) if (task->ptrace & PT_PTRACED)
goto bad; goto bad;
@ -166,17 +170,15 @@ int ptrace_attach(struct task_struct *task)
? PT_ATTACHED : 0); ? PT_ATTACHED : 0);
if (capable(CAP_SYS_PTRACE)) if (capable(CAP_SYS_PTRACE))
task->ptrace |= PT_PTRACE_CAP; task->ptrace |= PT_PTRACE_CAP;
task_unlock(task);
write_lock_irq(&tasklist_lock);
__ptrace_link(task, current); __ptrace_link(task, current);
write_unlock_irq(&tasklist_lock);
force_sig_specific(SIGSTOP, task); force_sig_specific(SIGSTOP, task);
return 0;
bad: bad:
write_unlock_irq(&tasklist_lock);
task_unlock(task); task_unlock(task);
out:
return retval; return retval;
} }
@ -417,21 +419,22 @@ int ptrace_request(struct task_struct *child, long request,
*/ */
int ptrace_traceme(void) int ptrace_traceme(void)
{ {
int ret; int ret = -EPERM;
/* /*
* Are we already being traced? * Are we already being traced?
*/ */
if (current->ptrace & PT_PTRACED) task_lock(current);
return -EPERM; if (!(current->ptrace & PT_PTRACED)) {
ret = security_ptrace(current->parent, current); ret = security_ptrace(current->parent, current);
if (ret) /*
return -EPERM; * Set the ptrace bit in the process ptrace flags.
/* */
* Set the ptrace bit in the process ptrace flags. if (!ret)
*/ current->ptrace |= PT_PTRACED;
current->ptrace |= PT_PTRACED; }
return 0; task_unlock(current);
return ret;
} }
/** /**