From patchwork Mon Feb 18 16:08:32 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 221410 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 6F7492C0077 for ; Tue, 19 Feb 2013 03:08:48 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1U7TGi-0008KH-Hz; Mon, 18 Feb 2013 16:08:40 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1U7TGf-0008JZ-Vk for kernel-team@lists.ubuntu.com; Mon, 18 Feb 2013 16:08:38 +0000 Received: from bl15-151-52.dsl.telepac.pt ([188.80.151.52] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1U7TGf-0004VT-QG for kernel-team@lists.ubuntu.com; Mon, 18 Feb 2013 16:08:37 +0000 From: Luis Henriques To: kernel-team@lists.ubuntu.com Subject: [Precise CVE 3/3] wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task Date: Mon, 18 Feb 2013 16:08:32 +0000 Message-Id: <1361203712-21643-4-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.1.2 In-Reply-To: <1361203712-21643-1-git-send-email-luis.henriques@canonical.com> References: <1361203712-21643-1-git-send-email-luis.henriques@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Oleg Nesterov CVE-2013-0871 BugLink: http://bugs.launchpad.net/bugs/1129192 wake_up_process() should never wakeup a TASK_STOPPED/TRACED task. Change it to use TASK_NORMAL and add the WARN_ON(). TASK_ALL has no other users, probably can be killed. Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds (backported from commit 9067ac85d533651b98c2ff903182a20cbb361fcb) Signed-off-by: Brad Figg Signed-off-by: Luis Henriques Conflicts: kernel/sched/core.c --- kernel/sched.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/sched.c b/kernel/sched.c index fcc893f..eeeec4e 100644 --- a/kernel/sched.c +++ b/kernel/sched.c @@ -2924,7 +2924,8 @@ out: */ int wake_up_process(struct task_struct *p) { - return try_to_wake_up(p, TASK_ALL, 0); + WARN_ON(task_is_stopped_or_traced(p)); + return try_to_wake_up(p, TASK_NORMAL, 0); } EXPORT_SYMBOL(wake_up_process);