From patchwork Tue Feb 19 17:31:08 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 221739 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 9F02E2C0291 for ; Wed, 20 Feb 2013 04:31:42 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1U7r2N-0005MH-OD; Tue, 19 Feb 2013 17:31:27 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1U7r2B-0005HG-3t for kernel-team@lists.ubuntu.com; Tue, 19 Feb 2013 17:31:15 +0000 Received: from bl15-111-189.dsl.telepac.pt ([188.80.111.189] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1U7r2A-0007wr-QR for kernel-team@lists.ubuntu.com; Tue, 19 Feb 2013 17:31:15 +0000 From: Luis Henriques To: kernel-team@lists.ubuntu.com Subject: [Lucid CVE 2/4] ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up() Date: Tue, 19 Feb 2013 17:31:08 +0000 Message-Id: <1361295070-14090-3-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.1.2 In-Reply-To: <1361295070-14090-1-git-send-email-luis.henriques@canonical.com> References: <1361295070-14090-1-git-send-email-luis.henriques@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Oleg Nesterov CVE-2013-0871 BugLink: http://bugs.launchpad.net/bugs/1129192 Cleanup and preparation for the next change. signal_wake_up(resume => true) is overused. None of ptrace/jctl callers actually want to wakeup a TASK_WAKEKILL task, but they can't specify the necessary mask. Turn signal_wake_up() into signal_wake_up_state(state), reintroduce signal_wake_up() as a trivial helper, and add ptrace_signal_wake_up() which adds __TASK_TRACED. This way ptrace_signal_wake_up() can work "inside" ptrace_request() even if the tracee doesn't have the TASK_WAKEKILL bit set. Signed-off-by: Oleg Nesterov Signed-off-by: Linus Torvalds (backported from commit 910ffdb18a6408e14febbb6e4b6840fd2c928c82) Conflicts: kernel/ptrace.c kernel/signal.c Signed-off-by: Luis Henriques --- include/linux/sched.h | 11 ++++++++++- kernel/ptrace.c | 2 +- kernel/signal.c | 12 +++--------- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index 297952b..2c3432c 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2462,7 +2462,16 @@ static inline void thread_group_cputime_free(struct signal_struct *sig) extern void recalc_sigpending_and_wake(struct task_struct *t); extern void recalc_sigpending(void); -extern void signal_wake_up(struct task_struct *t, int resume_stopped); +extern void signal_wake_up_state(struct task_struct *t, unsigned int state); + +static inline void signal_wake_up(struct task_struct *t, bool resume) +{ + signal_wake_up_state(t, resume ? TASK_WAKEKILL : 0); +} +static inline void ptrace_signal_wake_up(struct task_struct *t, bool resume) +{ + signal_wake_up_state(t, resume ? __TASK_TRACED : 0); +} /* * Wrappers for p->thread_info->cpu access. No-op on UP. diff --git a/kernel/ptrace.c b/kernel/ptrace.c index d8184b5..37850f9 100644 --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -56,7 +56,7 @@ static void ptrace_untrace(struct task_struct *child) child->signal->group_stop_count) __set_task_state(child, TASK_STOPPED); else - signal_wake_up(child, 1); + ptrace_signal_wake_up(child, true); } spin_unlock(&child->sighand->siglock); } diff --git a/kernel/signal.c b/kernel/signal.c index 2494827..c982975 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -513,23 +513,17 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info) * No need to set need_resched since signal event passing * goes through ->blocked */ -void signal_wake_up(struct task_struct *t, int resume) +void signal_wake_up_state(struct task_struct *t, unsigned int state) { - unsigned int mask; - set_tsk_thread_flag(t, TIF_SIGPENDING); - /* - * For SIGKILL, we want to wake it up in the stopped/traced/killable + * TASK_WAKEKILL also means wake it up in the stopped/traced/killable * case. We don't check t->state here because there is a race with it * executing another processor and just now entering stopped state. * By using wake_up_state, we ensure the process will wake up and * handle its death signal. */ - mask = TASK_INTERRUPTIBLE; - if (resume) - mask |= TASK_WAKEKILL; - if (!wake_up_state(t, mask)) + if (!wake_up_state(t, state | TASK_INTERRUPTIBLE)) kick_process(t); }