linux-kernel - [PATCH] ptrace: exit: re-trigger PTRACE_EVENT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 22 Nov 2021 01:53:47 +0100
From:   Vladimir Divjak <vladimir.divjak@....de>
To:     <vladimir.divjak@....de>, <oleg@...hat.com>,
        <jnewsome@...project.org>, <tglx@...utronix.de>,
        <akpm@...ux-foundation.org>, <asml.silence@...il.com>,
        <linux-kernel@...r.kernel.org>, <ebiederm@...ssion.com>
Subject: [PATCH] ptrace: exit: re-trigger PTRACE_EVENT_EXIT after coredump finished

Re-trigger PTRACE_EVENT_EXIT
(if one is requested with PTRACE_SEIZE setting PTRACE_O_TRACEEXIT option)
for a process being core-dumped, after the coredump is finished.

This enables a potential tracer - coredump user mode helper
(or any other tracer started after the coredump was initiated)
to receive the PTRACE_EVENT_EXIT for all threads of the crashing process.

Rationale:

For zapped threads, PTRACE_EVENT_EXIT is triggered early during do_exit(),
before the point at which they sleep, waiting for
coredump to finish - in exit_mm(), and before a potential
coredump user mode helper process is launched.

That makes it impossible for the coredump user mode helper process to
receive PTRACE_EVENT_EXIT events for all threads of the crashing process,
except for the thread handling the core-dump, which will trigger
the PTRACE_EVENT_EXIT after the coredump has been finished.

Signed-off-by: Vladimir Divjak <vladimir.divjak@....de>
---
 kernel/exit.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/exit.c b/kernel/exit.c
index fd1c04193e18..0157507e75a2 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -473,6 +473,13 @@ static void exit_mm(void)
 				break;
 			freezable_schedule();
 		}
+		/*
+		 * Re-trigger PTRACE_EVENT_EXIT for a process being core-dumped,
+		 * after the coredump finished (see above).
+		 * This enables the coredump user mode helper to receive PTRACE_EVENT_EXIT
+		 * for each thread of the dying process.
+		 */
+		ptrace_event(PTRACE_EVENT_EXIT, current->exit_code);
 		__set_current_state(TASK_RUNNING);
 		mmap_read_lock(mm);
 	}
-- 
2.25.1