# git rev-parse -q --verify dbb5afad100a828c97e012c6106566d99f041db6^{commit} dbb5afad100a828c97e012c6106566d99f041db6 already have revision, skipping fetch # git checkout -q -f -B kisskb dbb5afad100a828c97e012c6106566d99f041db6 # git clean -qxdf # < git log -1 # commit dbb5afad100a828c97e012c6106566d99f041db6 # Author: Oleg Nesterov # Date: Wed May 12 15:33:08 2021 +0200 # # ptrace: make ptrace() fail if the tracee changed its pid unexpectedly # # Suppose we have 2 threads, the group-leader L and a sub-theread T, # both parked in ptrace_stop(). Debugger tries to resume both threads # and does # # ptrace(PTRACE_CONT, T); # ptrace(PTRACE_CONT, L); # # If the sub-thread T execs in between, the 2nd PTRACE_CONT doesn not # resume the old leader L, it resumes the post-exec thread T which was # actually now stopped in PTHREAD_EVENT_EXEC. In this case the # PTHREAD_EVENT_EXEC event is lost, and the tracer can't know that the # tracee changed its pid. # # This patch makes ptrace() fail in this case until debugger does wait() # and consumes PTHREAD_EVENT_EXEC which reports old_pid. This affects all # ptrace requests except the "asynchronous" PTRACE_INTERRUPT/KILL. # # The patch doesn't add the new PTRACE_ option to not complicate the API, # and I _hope_ this won't cause any noticeable regression: # # - If debugger uses PTRACE_O_TRACEEXEC and the thread did an exec # and the tracer does a ptrace request without having consumed # the exec event, it's 100% sure that the thread the ptracer # thinks it is targeting does not exist anymore, or isn't the # same as the one it thinks it is targeting. # # - To some degree this patch adds nothing new. In the scenario # above ptrace(L) can fail with -ESRCH if it is called after the # execing sub-thread wakes the leader up and before it "steals" # the leader's pid. # # Test-case: # # #include # #include # #include # #include # #include # #include # #include # #include # # void *tf(void *arg) # { # execve("/usr/bin/true", NULL, NULL); # assert(0); # # return NULL; # } # # int main(void) # { # int leader = fork(); # if (!leader) { # kill(getpid(), SIGSTOP); # # pthread_t th; # pthread_create(&th, NULL, tf, NULL); # for (;;) # pause(); # # return 0; # } # # waitpid(leader, NULL, WSTOPPED); # # ptrace(PTRACE_SEIZE, leader, 0, # PTRACE_O_TRACECLONE | PTRACE_O_TRACEEXEC); # waitpid(leader, NULL, 0); # # ptrace(PTRACE_CONT, leader, 0,0); # waitpid(leader, NULL, 0); # # int status, thread = waitpid(-1, &status, 0); # assert(thread > 0 && thread != leader); # assert(status == 0x80137f); # # ptrace(PTRACE_CONT, thread, 0,0); # /* # * waitid() because waitpid(leader, &status, WNOWAIT) does not # * report status. Why ???? # * # * Why WEXITED? because we have another kernel problem connected # * to mt-exec. # */ # siginfo_t info; # assert(waitid(P_PID, leader, &info, WSTOPPED|WEXITED|WNOWAIT) == 0); # assert(info.si_pid == leader && info.si_status == 0x0405); # # /* OK, it sleeps in ptrace(PTRACE_EVENT_EXEC == 0x04) */ # assert(ptrace(PTRACE_CONT, leader, 0,0) == -1); # assert(errno == ESRCH); # # assert(leader == waitpid(leader, &status, WNOHANG)); # assert(status == 0x04057f); # # assert(ptrace(PTRACE_CONT, leader, 0,0) == 0); # # return 0; # } # # Signed-off-by: Oleg Nesterov # Reported-by: Simon Marchi # Acked-by: "Eric W. Biederman" # Acked-by: Pedro Alves # Acked-by: Simon Marchi # Acked-by: Jan Kratochvil # Signed-off-by: Linus Torvalds # < /opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux-gcc --version # < /opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux-ld --version # < git log --format=%s --max-count=1 dbb5afad100a828c97e012c6106566d99f041db6 # < make -s -j 48 ARCH=um O=/kisskb/build/linus_um-allyesconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 allyesconfig # Added to kconfig CONFIG_STANDALONE=y # Added to kconfig CONFIG_KCOV=n # Added to kconfig CONFIG_GCC_PLUGINS=n # Added to kconfig CONFIG_GCC_PLUGIN_CYC_COMPLEXITY=n # Added to kconfig CONFIG_GCC_PLUGIN_SANCOV=n # Added to kconfig CONFIG_GCC_PLUGIN_LATENT_ENTROPY=n # Added to kconfig CONFIG_GCC_PLUGIN_STRUCTLEAK=n # Added to kconfig CONFIG_GCC_PLUGIN_RANDSTRUCT=n # Added to kconfig CONFIG_UML_NET=n # Added to kconfig CONFIG_UML_NET_ETHERTAP=n # Added to kconfig CONFIG_UML_NET_TUNTAP=n # Added to kconfig CONFIG_UML_NET_SLIP=n # Added to kconfig CONFIG_UML_NET_DAEMON=n # Added to kconfig CONFIG_UML_NET_VDE=n # Added to kconfig CONFIG_UML_NET_MCAST=n # Added to kconfig CONFIG_UML_NET_PCAP=n # Added to kconfig CONFIG_UML_NET_SLIRP=n # Added to kconfig CONFIG_GCOV_KERNEL=n # Added to kconfig CONFIG_DEBUG_INFO_BTF=n # Added to kconfig CONFIG_BPF_PRELOAD=n # < make -s -j 48 ARCH=um O=/kisskb/build/linus_um-allyesconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 help # make -s -j 48 ARCH=um O=/kisskb/build/linus_um-allyesconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 olddefconfig .config:4574:warning: override: reassigning to symbol GCC_PLUGIN_CYC_COMPLEXITY .config:4576:warning: override: reassigning to symbol GCC_PLUGIN_LATENT_ENTROPY .config:4580:warning: override: reassigning to symbol UML_NET_ETHERTAP .config:4582:warning: override: reassigning to symbol UML_NET_SLIP .config:4585:warning: override: reassigning to symbol UML_NET_MCAST .config:4587:warning: override: reassigning to symbol UML_NET_SLIRP # make -s -j 48 ARCH=um O=/kisskb/build/linus_um-allyesconfig_um-x86_64 CROSS_COMPILE=/opt/cross/kisskb/fe-x86-64-core-i7-2017.05/bin/x86_64-linux- SUBARCH=x86_64 LINK linux Completed OK # rm -rf /kisskb/build/linus_um-allyesconfig_um-x86_64 # Build took: 0:05:53.387342