Patchwork [Precise,CVE,3/3] wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task

login
register
mail settings
Submitter Luis Henriques
Date Feb. 18, 2013, 4:08 p.m.
Message ID <1361203712-21643-4-git-send-email-luis.henriques@canonical.com>
Download mbox | patch
Permalink /patch/221410/
State New
Headers show

Comments

Luis Henriques - Feb. 18, 2013, 4:08 p.m.
From: Oleg Nesterov <oleg@redhat.com>

CVE-2013-0871

BugLink: http://bugs.launchpad.net/bugs/1129192

wake_up_process() should never wakeup a TASK_STOPPED/TRACED task.
Change it to use TASK_NORMAL and add the WARN_ON().

TASK_ALL has no other users, probably can be killed.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(backported from commit 9067ac85d533651b98c2ff903182a20cbb361fcb)

Signed-off-by: Brad Figg <brad.figg@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Conflicts:
	kernel/sched/core.c
---
 kernel/sched.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Patch

diff --git a/kernel/sched.c b/kernel/sched.c
index fcc893f..eeeec4e 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -2924,7 +2924,8 @@  out:
  */
 int wake_up_process(struct task_struct *p)
 {
-	return try_to_wake_up(p, TASK_ALL, 0);
+	WARN_ON(task_is_stopped_or_traced(p));
+	return try_to_wake_up(p, TASK_NORMAL, 0);
 }
 EXPORT_SYMBOL(wake_up_process);