mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
ptrace: Admit ptrace_stop can generate spuriuos SIGTRAPs
Long ago and far away there was a BUG_ON at the start of ptrace_stop that did "BUG_ON(!(current->ptrace & PT_PTRACED));" [1]. The BUG_ON had never triggered but examination of the code showed that the BUG_ON could actually trigger. To complement removing the BUG_ON an attempt to better handle the race was added. The code detected the tracer had gone away and did not call do_notify_parent_cldstop. The code also attempted to prevent ptrace_report_syscall from sending spurious SIGTRAPs when the tracer went away. The code to detect when the tracer had gone away before sending a signal to tracer was a legitimate fix and continues to work to this date. The code to prevent sending spurious SIGTRAPs is a failure. At the time and until today the code only catches it when the tracer goes away after siglock is dropped and before read_lock is acquired. If the tracer goes away after read_lock is dropped a spurious SIGTRAP can still be sent to the tracee. The tracer going away after read_lock is dropped is the far likelier case as it is the bigger window. Given that the attempt to prevent the generation of a SIGTRAP was a failure and continues to be a failure remove the code that attempts to do that. This simplifies the code in ptrace_stop and makes ptrace_stop much easier to reason about. To successfully deal with the tracer going away, all of the tracer's instrumentation of the child would need to be removed, and reliably detecting when the tracer has set a signal to continue with would need to be implemented. [1] 66519f549ae5 ("[PATCH] fix ptracer death race yielding bogus BUG_ON") History-Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git Tested-by: Kees Cook <keescook@chromium.org> Reviewed-by: Oleg Nesterov <oleg@redhat.com> Link: https://lkml.kernel.org/r/20220505182645.497868-9-ebiederm@xmission.com Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
This commit is contained in:
parent
7b0fe1367e
commit
57b6de08b5
|
@ -2187,13 +2187,12 @@ static void do_notify_parent_cldstop(struct task_struct *tsk,
|
|||
* with. If the code did not stop because the tracer is gone,
|
||||
* the stop signal remains unchanged unless clear_code.
|
||||
*/
|
||||
static int ptrace_stop(int exit_code, int why, int clear_code,
|
||||
unsigned long message, kernel_siginfo_t *info)
|
||||
static int ptrace_stop(int exit_code, int why, unsigned long message,
|
||||
kernel_siginfo_t *info)
|
||||
__releases(¤t->sighand->siglock)
|
||||
__acquires(¤t->sighand->siglock)
|
||||
{
|
||||
bool gstop_done = false;
|
||||
bool read_code = true;
|
||||
|
||||
if (arch_ptrace_stop_needed()) {
|
||||
/*
|
||||
|
@ -2212,7 +2211,14 @@ static int ptrace_stop(int exit_code, int why, int clear_code,
|
|||
/*
|
||||
* schedule() will not sleep if there is a pending signal that
|
||||
* can awaken the task.
|
||||
*
|
||||
* After this point ptrace_signal_wake_up will clear TASK_TRACED
|
||||
* if ptrace_unlink happens. Handle previous ptrace_unlinks
|
||||
* here to prevent ptrace_stop sleeping in schedule.
|
||||
*/
|
||||
if (!current->ptrace)
|
||||
return exit_code;
|
||||
|
||||
set_special_state(TASK_TRACED);
|
||||
|
||||
/*
|
||||
|
@ -2259,54 +2265,33 @@ static int ptrace_stop(int exit_code, int why, int clear_code,
|
|||
|
||||
spin_unlock_irq(¤t->sighand->siglock);
|
||||
read_lock(&tasklist_lock);
|
||||
if (likely(current->ptrace)) {
|
||||
/*
|
||||
* Notify parents of the stop.
|
||||
*
|
||||
* While ptraced, there are two parents - the ptracer and
|
||||
* the real_parent of the group_leader. The ptracer should
|
||||
* know about every stop while the real parent is only
|
||||
* interested in the completion of group stop. The states
|
||||
* for the two don't interact with each other. Notify
|
||||
* separately unless they're gonna be duplicates.
|
||||
*/
|
||||
/*
|
||||
* Notify parents of the stop.
|
||||
*
|
||||
* While ptraced, there are two parents - the ptracer and
|
||||
* the real_parent of the group_leader. The ptracer should
|
||||
* know about every stop while the real parent is only
|
||||
* interested in the completion of group stop. The states
|
||||
* for the two don't interact with each other. Notify
|
||||
* separately unless they're gonna be duplicates.
|
||||
*/
|
||||
if (current->ptrace)
|
||||
do_notify_parent_cldstop(current, true, why);
|
||||
if (gstop_done && ptrace_reparented(current))
|
||||
do_notify_parent_cldstop(current, false, why);
|
||||
if (gstop_done && (!current->ptrace || ptrace_reparented(current)))
|
||||
do_notify_parent_cldstop(current, false, why);
|
||||
|
||||
/*
|
||||
* Don't want to allow preemption here, because
|
||||
* sys_ptrace() needs this task to be inactive.
|
||||
*
|
||||
* XXX: implement read_unlock_no_resched().
|
||||
*/
|
||||
preempt_disable();
|
||||
read_unlock(&tasklist_lock);
|
||||
cgroup_enter_frozen();
|
||||
preempt_enable_no_resched();
|
||||
freezable_schedule();
|
||||
cgroup_leave_frozen(true);
|
||||
} else {
|
||||
/*
|
||||
* By the time we got the lock, our tracer went away.
|
||||
* Don't drop the lock yet, another tracer may come.
|
||||
*
|
||||
* If @gstop_done, the ptracer went away between group stop
|
||||
* completion and here. During detach, it would have set
|
||||
* JOBCTL_STOP_PENDING on us and we'll re-enter
|
||||
* TASK_STOPPED in do_signal_stop() on return, so notifying
|
||||
* the real parent of the group stop completion is enough.
|
||||
*/
|
||||
if (gstop_done)
|
||||
do_notify_parent_cldstop(current, false, why);
|
||||
|
||||
/* tasklist protects us from ptrace_freeze_traced() */
|
||||
__set_current_state(TASK_RUNNING);
|
||||
read_code = false;
|
||||
if (clear_code)
|
||||
exit_code = 0;
|
||||
read_unlock(&tasklist_lock);
|
||||
}
|
||||
/*
|
||||
* Don't want to allow preemption here, because
|
||||
* sys_ptrace() needs this task to be inactive.
|
||||
*
|
||||
* XXX: implement read_unlock_no_resched().
|
||||
*/
|
||||
preempt_disable();
|
||||
read_unlock(&tasklist_lock);
|
||||
cgroup_enter_frozen();
|
||||
preempt_enable_no_resched();
|
||||
freezable_schedule();
|
||||
cgroup_leave_frozen(true);
|
||||
|
||||
/*
|
||||
* We are back. Now reacquire the siglock before touching
|
||||
|
@ -2314,8 +2299,7 @@ static int ptrace_stop(int exit_code, int why, int clear_code,
|
|||
* any signal-sending on another CPU that wants to examine it.
|
||||
*/
|
||||
spin_lock_irq(¤t->sighand->siglock);
|
||||
if (read_code)
|
||||
exit_code = current->exit_code;
|
||||
exit_code = current->exit_code;
|
||||
current->last_siginfo = NULL;
|
||||
current->ptrace_message = 0;
|
||||
current->exit_code = 0;
|
||||
|
@ -2343,7 +2327,7 @@ static int ptrace_do_notify(int signr, int exit_code, int why, unsigned long mes
|
|||
info.si_uid = from_kuid_munged(current_user_ns(), current_uid());
|
||||
|
||||
/* Let the debugger run. */
|
||||
return ptrace_stop(exit_code, why, 1, message, &info);
|
||||
return ptrace_stop(exit_code, why, message, &info);
|
||||
}
|
||||
|
||||
int ptrace_notify(int exit_code, unsigned long message)
|
||||
|
@ -2515,7 +2499,7 @@ static void do_jobctl_trap(void)
|
|||
CLD_STOPPED, 0);
|
||||
} else {
|
||||
WARN_ON_ONCE(!signr);
|
||||
ptrace_stop(signr, CLD_STOPPED, 0, 0, NULL);
|
||||
ptrace_stop(signr, CLD_STOPPED, 0, NULL);
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -2568,7 +2552,7 @@ static int ptrace_signal(int signr, kernel_siginfo_t *info, enum pid_type type)
|
|||
* comment in dequeue_signal().
|
||||
*/
|
||||
current->jobctl |= JOBCTL_STOP_DEQUEUED;
|
||||
signr = ptrace_stop(signr, CLD_TRAPPED, 0, 0, info);
|
||||
signr = ptrace_stop(signr, CLD_TRAPPED, 0, info);
|
||||
|
||||
/* We're back. Did the debugger cancel the sig? */
|
||||
if (signr == 0)
|
||||
|
|
Loading…
Reference in a new issue