| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 6 Jun 2017 14:03:29 -0500
From: "Eric W. Biederman" <ebiederm@...ssion.com>
To: linux-kernel@...r.kernel.org
Cc: linux-api@...r.kernel.org,
Linus Torvalds <torvalds@...ux-foundation.org>,
Oleg Nesterov <oleg@...hat.com>,
Ingo Molnar <mingo@...nel.org>,
Thomas Gleixner <tglx@...utronix.de>,
Kees Cook <keescook@...omium.org>,
Roland McGrath <roland@...k.frob.com>,
Al Viro <viro@...IV.linux.org.uk>,
David Howells <dhowells@...hat.com>,
"Michael Kerrisk (man-pages)" <mtk.manpages@...il.com>,
"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: [PATCH 17/26] exit: Rework the exit states for ptracees
Create two new exit states EXIT_TRACEE and EXIT_TRACED replacing
the two states "(EXIT_ZOMBIE && (!thread_group_leader(p) || !ptrace_reparented))
and EXIT_TRACE. With EXIT_ZOMBIE replacing the state:
"(EXIT_ZOMBIE && thread_group_leader(p) && !ptrace_reparented)".
Rework the code to take advantage of the certain knowledge of
exit state progression:
EXIT_TRACEE -> EXIT_TRACED -> EXIT_ZOMBIE -> EXIT_DEAD
This makes the code more readable/maintainable by using simple states
rather than complicated expressions. The values of both of the new
states contain EXIT_ZOMBIE so all of these states appear to userspace
as zombies.
Signed-off-by: "Eric W. Biederman" <ebiederm@...ssion.com>
---
include/linux/sched.h | 6 +++++-
kernel/exit.c | 51 +++++++++++++++++++++++----------------------------
kernel/ptrace.c | 31 +++++++++++++++++--------------
3 files changed, 45 insertions(+), 43 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 461ecd20731c..f2cec7f27e59 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -73,7 +73,6 @@ struct task_group;
/* Used in tsk->exit_state: */
#define EXIT_DEAD 16
#define EXIT_ZOMBIE 32
-#define EXIT_TRACE (EXIT_ZOMBIE | EXIT_DEAD)
/* Used in tsk->state again: */
#define TASK_DEAD 64
#define TASK_WAKEKILL 128
@@ -82,6 +81,11 @@ struct task_group;
#define TASK_NOLOAD 1024
#define TASK_NEW 2048
#define TASK_STATE_MAX 4096
+/* Used in tsk->exit_state again: */
+#define __EXIT_TRACEE 8192
+#define __EXIT_TRACED 16384
+#define EXIT_TRACEE (EXIT_ZOMBIE | __EXIT_TRACEE)
+#define EXIT_TRACED (EXIT_ZOMBIE | __EXIT_TRACED)
#define TASK_STATE_TO_CHAR_STR "RSDTtXZxKWPNn"
diff --git a/kernel/exit.c b/kernel/exit.c
index 72591eb5e361..ff2ed1d60a8c 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -580,8 +580,7 @@ static void reparent_leader(struct task_struct *father, struct task_struct *p,
p->exit_signal = SIGCHLD;
/* If it has exited notify the new parent about this child's death. */
- if (!p->ptrace &&
- p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
+ if (p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
if (do_notify_parent(p, p->exit_signal)) {
p->exit_state = EXIT_DEAD;
list_add(&p->ptrace_entry, dead);
@@ -639,7 +638,7 @@ static void forget_original_parent(struct task_struct *father,
*/
static void exit_notify(struct task_struct *tsk, int group_dead)
{
- bool autoreap = true;
+ int state = EXIT_DEAD;
struct task_struct *p, *n;
LIST_HEAD(dead);
@@ -650,14 +649,18 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
kill_orphaned_pgrp(tsk->group_leader, NULL);
if (thread_group_leader(tsk) && !ptrace_reparented(tsk)) {
- autoreap = thread_group_empty(tsk) &&
- do_notify_parent(tsk, tsk->exit_signal);
+ state = EXIT_ZOMBIE;
+ if (thread_group_empty(tsk) &&
+ do_notify_parent(tsk, tsk->exit_signal))
+ state = EXIT_DEAD;
}
else if (unlikely(tsk->ptrace)) {
- autoreap = do_notify_parent(tsk, SIGCHLD);
+ state = EXIT_TRACEE;
+ if (do_notify_parent(tsk, SIGCHLD))
+ state = EXIT_DEAD;
}
- tsk->exit_state = autoreap ? EXIT_DEAD : EXIT_ZOMBIE;
+ tsk->exit_state = state;
if (tsk->exit_state == EXIT_DEAD)
list_add(&tsk->ptrace_entry, &dead);
@@ -1001,7 +1004,7 @@ static int wait_noreap_copyout(struct wait_opts *wo, struct task_struct *p,
* the lock and this task is uninteresting. If we return nonzero, we have
* released the lock and the system call should return.
*/
-static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
+static int wait_task_zombie(struct wait_opts *wo, int old_state, struct task_struct *p)
{
int state, retval, status;
pid_t pid = task_pid_vnr(p);
@@ -1029,11 +1032,11 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
return wait_noreap_copyout(wo, p, pid, uid, why, status);
}
/*
- * Move the task's state to DEAD/TRACE, only one thread can do this.
+ * Move the task's state to DEAD/TRACED only one thread can do this.
*/
- state = (ptrace_reparented(p) && thread_group_leader(p)) ?
- EXIT_TRACE : EXIT_DEAD;
- if (cmpxchg(&p->exit_state, EXIT_ZOMBIE, state) != EXIT_ZOMBIE)
+ state = ((old_state == EXIT_TRACEE) && thread_group_leader(p)) ?
+ EXIT_TRACED : EXIT_DEAD;
+ if (cmpxchg(&p->exit_state, old_state, state) != old_state)
return 0;
/*
* We own this thread, nobody else can reap it.
@@ -1041,10 +1044,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
read_unlock(&tasklist_lock);
sched_annotate_sleep();
- /*
- * Check thread_group_leader() to exclude the traced sub-threads.
- */
- if (state == EXIT_DEAD && thread_group_leader(p)) {
+ if (old_state == EXIT_ZOMBIE) {
struct signal_struct *sig = p->signal;
struct signal_struct *psig = current->signal;
unsigned long maxrss;
@@ -1132,7 +1132,7 @@ static int wait_task_zombie(struct wait_opts *wo, struct task_struct *p)
if (!retval)
retval = pid;
- if (state == EXIT_TRACE) {
+ if (state == EXIT_TRACED) {
write_lock_irq(&tasklist_lock);
/* We dropped tasklist, ptracer could die and untrace */
ptrace_unlink(p);
@@ -1335,8 +1335,7 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
{
/*
* We can race with wait_task_zombie() from another thread.
- * Ensure that EXIT_ZOMBIE -> EXIT_DEAD/EXIT_TRACE transition
- * can't confuse the checks below.
+ * Ensure that exit_state transition can't confuse the checks below.
*/
int exit_state = ACCESS_ONCE(p->exit_state);
int ret;
@@ -1349,11 +1348,8 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
return ret;
/* zombie child process? */
- if ((exit_state == EXIT_ZOMBIE) &&
- !ptrace_reparented(p) &&
- thread_group_leader(p) &&
- thread_group_empty(p))
- return wait_task_zombie(wo, p);
+ if ((exit_state == EXIT_ZOMBIE) && thread_group_empty(p))
+ return wait_task_zombie(wo, exit_state, p);
/*
* A zombie ptracee that is not a child of it's ptracer's
@@ -1361,11 +1357,10 @@ static int wait_consider_task(struct wait_opts *wo, int ptrace,
* and reaping will be cascaded to the real parent when the
* ptracer detaches.
*/
- if ((exit_state == EXIT_ZOMBIE) && ptrace &&
- (!thread_group_leader(p) || ptrace_reparented(p)))
- return wait_task_zombie(wo, p);
+ if ((exit_state == EXIT_TRACEE) && ptrace)
+ return wait_task_zombie(wo, exit_state, p);
- if (unlikely(exit_state == EXIT_TRACE)) {
+ if (unlikely(exit_state == EXIT_TRACED)) {
/*
* ptrace == 0 means we are the natural parent. In this case
* we should clear notask_error, debugger will notify us.
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 490333db9e21..003567a615f9 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -497,27 +497,30 @@ static int ignoring_children(struct sighand_struct *sigh)
*/
static bool __exit_ptrace(struct task_struct *tracer, struct task_struct *p)
{
- bool dead;
+ int state = p->exit_state;
__ptrace_unlink(p);
- if (p->exit_state != EXIT_ZOMBIE)
- return false;
-
- dead = !thread_group_leader(p);
-
- if (!dead && thread_group_empty(p)) {
- if (!same_thread_group(p->real_parent, tracer))
- dead = do_notify_parent(p, p->exit_signal);
- else if (ignoring_children(tracer->sighand)) {
+ if (state == EXIT_ZOMBIE) {
+ /* Honor the parents request to autoreap children */
+ if (thread_group_empty(p) &&
+ ignoring_children(tracer->sighand)) {
+ state = EXIT_DEAD;
__wake_up_parent(p, tracer);
- dead = true;
+ }
+ }
+ else if (state == EXIT_TRACEE) {
+ state = EXIT_DEAD;
+ if (thread_group_leader(p)) {
+ state = EXIT_ZOMBIE;
+ if (thread_group_empty(p) &&
+ do_notify_parent(p, p->exit_signal))
+ state = EXIT_DEAD;
}
}
/* Mark it as in the process of being reaped. */
- if (dead)
- p->exit_state = EXIT_DEAD;
- return dead;
+ p->exit_state = state;
+ return state == EXIT_DEAD;
}
static int ptrace_detach(struct task_struct *child, unsigned int data)
--
2.10.1
Powered by blists - more mailing lists