3.16.52-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov oleg@redhat.com
commit 1333ab03150478df8d6f5673a91df1e50dc6ab97 upstream.
This test-case (simplified version of generated by syzkaller)
#include <unistd.h> #include <sys/ptrace.h> #include <sys/wait.h>
void test(void) { for (;;) { if (fork()) { wait(NULL); continue; }
ptrace(PTRACE_SEIZE, getppid(), 0, 0); ptrace(PTRACE_INTERRUPT, getppid(), 0, 0); _exit(0); } }
int main(void) { int np;
for (np = 0; np < 8; ++np) if (!fork()) test();
while (wait(NULL) > 0) ; return 0; }
triggers the 2nd WARN_ON_ONCE(!signr) warning in do_jobctl_trap(). The problem is that __ptrace_unlink() clears task->jobctl under siglock but task->ptrace is cleared without this lock held; this fools the "else" branch which assumes that !PT_SEIZED means PT_PTRACED.
Note also that most of other PTRACE_SEIZE checks can race with detach from the exiting tracer too. Say, the callers of ptrace_trap_notify() assume that SEIZED can't go away after it was checked.
Signed-off-by: Oleg Nesterov oleg@redhat.com Reported-by: Dmitry Vyukov dvyukov@google.com Cc: Tejun Heo tj@kernel.org Cc: syzkaller syzkaller@googlegroups.com Signed-off-by: Andrew Morton akpm@linux-foundation.org Signed-off-by: Linus Torvalds torvalds@linux-foundation.org Signed-off-by: Ben Hutchings ben@decadent.org.uk --- kernel/ptrace.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
--- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -79,12 +79,11 @@ void __ptrace_unlink(struct task_struct { BUG_ON(!child->ptrace);
- child->ptrace = 0; child->parent = child->real_parent; list_del_init(&child->ptrace_entry);
spin_lock(&child->sighand->siglock); - + child->ptrace = 0; /* * Clear all pending traps and TRAPPING. TRAPPING should be * cleared regardless of JOBCTL_STOP_PENDING. Do it explicitly.