提交 b79b7ba9 编写于 作者: O Oleg Nesterov 提交者: Linus Torvalds

ptrace: ptrace_attach: check PF_KTHREAD + exit_state instead of ->mm

- Add PF_KTHREAD check to prevent attaching to the kernel thread
  with a borrowed ->mm.

  With or without this change we can race with daemonize() which
  can set PF_KTHREAD or clear ->mm after ptrace_attach() does the
  check, but this doesn't matter because reparent_to_kthreadd()
  does ptrace_unlink().

- Kill "!task->mm" check. We don't really care about ->mm != NULL,
  and the task can call exit_mm() right after we drop task_lock().
  What we need is to make sure we can't attach after exit_notify(),
  check task->exit_state != 0 instead.

Also, move the "already traced" check down for cosmetic reasons.
Signed-off-by: NOleg Nesterov <oleg@redhat.com>
Cc: Chris Wright <chrisw@sous-sol.org>
Acked-by: NRoland McGrath <roland@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 5cb11446
......@@ -172,6 +172,8 @@ int ptrace_attach(struct task_struct *task)
audit_ptrace(task);
retval = -EPERM;
if (unlikely(task->flags & PF_KTHREAD))
goto out;
if (same_thread_group(task, current))
goto out;
......@@ -182,8 +184,6 @@ int ptrace_attach(struct task_struct *task)
retval = mutex_lock_interruptible(&task->cred_guard_mutex);
if (retval < 0)
goto out;
retval = -EPERM;
repeat:
/*
* Nasty, nasty.
......@@ -203,23 +203,24 @@ int ptrace_attach(struct task_struct *task)
goto repeat;
}
if (!task->mm)
goto bad;
/* the same process cannot be attached many times */
if (task->ptrace & PT_PTRACED)
goto bad;
retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
if (retval)
goto bad;
/* Go */
retval = -EPERM;
if (unlikely(task->exit_state))
goto bad;
if (task->ptrace & PT_PTRACED)
goto bad;
task->ptrace |= PT_PTRACED;
if (capable(CAP_SYS_PTRACE))
task->ptrace |= PT_PTRACE_CAP;
__ptrace_link(task, current);
send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);
retval = 0;
bad:
write_unlock_irqrestore(&tasklist_lock, flags);
task_unlock(task);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册