# git rev-parse -q --verify dbb5afad100a828c97e012c6106566d99f041db6^{commit} dbb5afad100a828c97e012c6106566d99f041db6 already have revision, skipping fetch # git checkout -q -f -B kisskb dbb5afad100a828c97e012c6106566d99f041db6 # git clean -qxdf # < git log -1 # commit dbb5afad100a828c97e012c6106566d99f041db6 # Author: Oleg Nesterov # Date: Wed May 12 15:33:08 2021 +0200 # # ptrace: make ptrace() fail if the tracee changed its pid unexpectedly # # Suppose we have 2 threads, the group-leader L and a sub-theread T, # both parked in ptrace_stop(). Debugger tries to resume both threads # and does # # ptrace(PTRACE_CONT, T); # ptrace(PTRACE_CONT, L); # # If the sub-thread T execs in between, the 2nd PTRACE_CONT doesn not # resume the old leader L, it resumes the post-exec thread T which was # actually now stopped in PTHREAD_EVENT_EXEC. In this case the # PTHREAD_EVENT_EXEC event is lost, and the tracer can't know that the # tracee changed its pid. # # This patch makes ptrace() fail in this case until debugger does wait() # and consumes PTHREAD_EVENT_EXEC which reports old_pid. This affects all # ptrace requests except the "asynchronous" PTRACE_INTERRUPT/KILL. # # The patch doesn't add the new PTRACE_ option to not complicate the API, # and I _hope_ this won't cause any noticeable regression: # # - If debugger uses PTRACE_O_TRACEEXEC and the thread did an exec # and the tracer does a ptrace request without having consumed # the exec event, it's 100% sure that the thread the ptracer # thinks it is targeting does not exist anymore, or isn't the # same as the one it thinks it is targeting. # # - To some degree this patch adds nothing new. In the scenario # above ptrace(L) can fail with -ESRCH if it is called after the # execing sub-thread wakes the leader up and before it "steals" # the leader's pid. # # Test-case: # # #include # #include # #include # #include # #include # #include # #include # #include # # void *tf(void *arg) # { # execve("/usr/bin/true", NULL, NULL); # assert(0); # # return NULL; # } # # int main(void) # { # int leader = fork(); # if (!leader) { # kill(getpid(), SIGSTOP); # # pthread_t th; # pthread_create(&th, NULL, tf, NULL); # for (;;) # pause(); # # return 0; # } # # waitpid(leader, NULL, WSTOPPED); # # ptrace(PTRACE_SEIZE, leader, 0, # PTRACE_O_TRACECLONE | PTRACE_O_TRACEEXEC); # waitpid(leader, NULL, 0); # # ptrace(PTRACE_CONT, leader, 0,0); # waitpid(leader, NULL, 0); # # int status, thread = waitpid(-1, &status, 0); # assert(thread > 0 && thread != leader); # assert(status == 0x80137f); # # ptrace(PTRACE_CONT, thread, 0,0); # /* # * waitid() because waitpid(leader, &status, WNOWAIT) does not # * report status. Why ???? # * # * Why WEXITED? because we have another kernel problem connected # * to mt-exec. # */ # siginfo_t info; # assert(waitid(P_PID, leader, &info, WSTOPPED|WEXITED|WNOWAIT) == 0); # assert(info.si_pid == leader && info.si_status == 0x0405); # # /* OK, it sleeps in ptrace(PTRACE_EVENT_EXEC == 0x04) */ # assert(ptrace(PTRACE_CONT, leader, 0,0) == -1); # assert(errno == ESRCH); # # assert(leader == waitpid(leader, &status, WNOHANG)); # assert(status == 0x04057f); # # assert(ptrace(PTRACE_CONT, leader, 0,0) == 0); # # return 0; # } # # Signed-off-by: Oleg Nesterov # Reported-by: Simon Marchi # Acked-by: "Eric W. Biederman" # Acked-by: Pedro Alves # Acked-by: Simon Marchi # Acked-by: Jan Kratochvil # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/korg/gcc-4.9.4-nolibc/ia64-linux/bin/ia64-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-4.9.4-nolibc/ia64-linux/bin/ia64-linux-ld --version # < git log --format=%s --max-count=1 dbb5afad100a828c97e012c6106566d99f041db6 # < make -s -j 48 ARCH=ia64 O=/kisskb/build/linus_ia64-defconfig_ia64-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/ia64-linux/bin/ia64-linux- defconfig # < make -s -j 48 ARCH=ia64 O=/kisskb/build/linus_ia64-defconfig_ia64-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/ia64-linux/bin/ia64-linux- help # make -s -j 48 ARCH=ia64 O=/kisskb/build/linus_ia64-defconfig_ia64-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/ia64-linux/bin/ia64-linux- olddefconfig # make -s -j 48 ARCH=ia64 O=/kisskb/build/linus_ia64-defconfig_ia64-gcc4.9 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-4.9.4-nolibc/ia64-linux/bin/ia64-linux- :1511:2: warning: #warning syscall clone3 not implemented [-Wcpp] /kisskb/src/net/sched/sch_frag.c: In function 'sch_fragment': /kisskb/src/net/sched/sch_frag.c:93:10: warning: missing braces around initializer [-Wmissing-braces] struct rtable sch_frag_rt = { 0 }; ^ /kisskb/src/net/sched/sch_frag.c:93:10: warning: (near initialization for 'sch_frag_rt.dst') [-Wmissing-braces] No errors detected in 22592 functions. Completed OK # rm -rf /kisskb/build/linus_ia64-defconfig_ia64-gcc4.9 # Build took: 0:02:18.373428