linux-kernel - [RFC,PATCH 3/3] do_wait: fix waiting for stopped group with dead leader

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 8 Dec 2007 21:38:02 +0300
From:	Oleg Nesterov <oleg@...sign.ru>
To:	Andrew Morton <akpm@...ux-foundation.org>,
	Davide Libenzi <davidel@...ilserver.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Ingo Molnar <mingo@...e.hu>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Roland McGrath <roland@...hat.com>
Cc:	linux-kernel@...r.kernel.org
Subject: [RFC,PATCH 3/3] do_wait: fix waiting for stopped group with dead leader

do_wait(WSTOPPED) assumes that p->state must be == TASK_STOPPED, this is not
true if the leader is already dead. Check SIGNAL_STOP_STOPPED instead and use
->signal->group_exit_code.

This patch is not complete if not buggy. At the very minimum it needs cleanup.

Signed-off-by: Oleg Nesterov <oleg@...sign.ru>

--- PT/kernel/exit.c~6_wait_stop	2007-12-07 20:25:40.000000000 +0300
+++ PT/kernel/exit.c	2007-12-08 20:30:55.000000000 +0300
@@ -1316,6 +1316,11 @@ static int wait_task_zombie(struct task_
 	return retval;
 }
 
+static inline int is_task_wait_stopped(struct task_struct *p)
+{
+	return	is_task_stopped_or_traced(p) ||
+		(p->signal->flags & SIGNAL_STOP_STOPPED);
+}
 /*
  * Handle sys_wait4 work for one task in state TASK_STOPPED.  We hold
  * read_lock(&tasklist_lock) on entry.  If we return zero, we still hold
@@ -1326,29 +1331,28 @@ static int wait_task_stopped(struct task
 			     int noreap, struct siginfo __user *infop,
 			     int __user *stat_addr, struct rusage __user *ru)
 {
-	int retval, exit_code, why;
+	int retval, *p_code, exit_code, why;
 	uid_t uid = 0; /* unneeded, required by compiler */
 	pid_t pid;
 
 	exit_code = 0;
 	spin_lock_irq(&p->sighand->siglock);
+	if (p->ptrace & PT_PTRACED) {
+		if (!is_task_stopped_or_traced(p))
+			goto unlock_sig;
+		p_code = &p->exit_code;
+	} else {
+		if (!(p->signal->flags & SIGNAL_STOP_STOPPED))
+			goto unlock_sig;
+		p_code = &p->signal->group_exit_code;
+	}
 
-	if (unlikely(!is_task_stopped_or_traced(p)))
-		goto unlock_sig;
-
-	if (!(p->ptrace & PT_PTRACED) && p->signal->group_stop_count > 0)
-		/*
-		 * A group stop is in progress and this is the group leader.
-		 * We won't report until all threads have stopped.
-		 */
-		goto unlock_sig;
-
-	exit_code = p->exit_code;
+	exit_code = *p_code;
 	if (!exit_code)
 		goto unlock_sig;
 
 	if (!noreap)
-		p->exit_code = 0;
+		*p_code = 0;
 
 	uid = p->uid;
 unlock_sig:
@@ -1472,7 +1476,7 @@ repeat:
 
 			if (unlikely(ret < 0)) {
 				retval = ret;
-			} else if (is_task_stopped_or_traced(p)) {
+			} else if (is_task_wait_stopped(p)) {
 				/*
 				 * It's stopped now, so it might later
 				 * continue, exit, or stop again.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/