[RHEL8,COMMIT] ms/ptrace: fix task_join_group_stop() for the case when current is traced

Submitted by Konstantin Khorenko on Dec. 22, 2020, 2:02 p.m.

Details

Message ID 202012221402.0BME27gm228677@finist-co8.sw.ru
State New
Series "ptrace: fix task_join_group_stop() for the case when current is traced"
Headers show

Commit Message

Konstantin Khorenko Dec. 22, 2020, 2:02 p.m. 
The commit is pushed to "branch-rh8-4.18.0-240.1.1.vz8.5.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-240.1.1.vz8.5.3
------>
commit 375b9696ec2b0eb6af3a22647ade8e9881d03133
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Tue Dec 22 17:02:07 2020 +0300

    ms/ptrace: fix task_join_group_stop() for the case when current is traced
    
    This testcase
    
            #include <stdio.h>
            #include <unistd.h>
            #include <signal.h>
            #include <sys/ptrace.h>
            #include <sys/wait.h>
            #include <pthread.h>
            #include <assert.h>
    
            void *tf(void *arg)
            {
                    return NULL;
            }
    
            int main(void)
            {
                    int pid = fork();
                    if (!pid) {
                            kill(getpid(), SIGSTOP);
    
                            pthread_t th;
                            pthread_create(&th, NULL, tf, NULL);
    
                            return 0;
                    }
    
                    waitpid(pid, NULL, WSTOPPED);
    
                    ptrace(PTRACE_SEIZE, pid, 0, PTRACE_O_TRACECLONE);
                    waitpid(pid, NULL, 0);
    
                    ptrace(PTRACE_CONT, pid, 0,0);
                    waitpid(pid, NULL, 0);
    
                    int status;
                    int thread = waitpid(-1, &status, 0);
                    assert(thread > 0 && thread != pid);
                    assert(status == 0x80137f);
    
                    return 0;
            }
    
    fails and triggers WARN_ON_ONCE(!signr) in do_jobctl_trap().
    
    This is because task_join_group_stop() has 2 problems when current is traced:
    
            1. We can't rely on the "JOBCTL_STOP_PENDING" check, a stopped tracee
               can be woken up by debugger and it can clone another thread which
               should join the group-stop.
    
               We need to check group_stop_count || SIGNAL_STOP_STOPPED.
    
            2. If SIGNAL_STOP_STOPPED is already set, we should not increment
               sig->group_stop_count and add JOBCTL_STOP_CONSUME. The new thread
               should stop without another do_notify_parent_cldstop() report.
    
    To clarify, the problem is very old and we should blame
    ptrace_init_task().  But now that we have task_join_group_stop() it makes
    more sense to fix this helper to avoid the code duplication.
    
    Reported-by: syzbot+3485e3773f7da290eecc@syzkaller.appspotmail.com
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: Christian Brauner <christian@brauner.io>
    Cc: "Eric W . Biederman" <ebiederm@xmission.com>
    Cc: Zhiqiang Liu <liuzhiqiang26@huawei.com>
    Cc: Tejun Heo <tj@kernel.org>
    Cc: <stable@vger.kernel.org>
    Link: https://lkml.kernel.org/r/20201019134237.GA18810@redhat.com
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    
    https://jira.sw.ru/browse/PSBM-123525
    (cherry picked from commit 7b3c36fc4c231ca532120bbc0df67a12f09c1d96)
    Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
---
 kernel/signal.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

Patch hide | download patch | download mbox 

diff --git a/kernel/signal.c b/kernel/signal.c
index 177cd7f04acb..171f7496f811 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -388,16 +388,17 @@  static bool task_participate_group_stop(struct task_struct *task)
 
 void task_join_group_stop(struct task_struct *task)
 {
+	unsigned long mask = current->jobctl & JOBCTL_STOP_SIGMASK;
+	struct signal_struct *sig = current->signal;
+
+	if (sig->group_stop_count) {
+		sig->group_stop_count++;
+		mask |= JOBCTL_STOP_CONSUME;
+	} else if (!(sig->flags & SIGNAL_STOP_STOPPED))
+		return;
+
 	/* Have the new thread join an on-going signal group stop */
-	unsigned long jobctl = current->jobctl;
-	if (jobctl & JOBCTL_STOP_PENDING) {
-		struct signal_struct *sig = current->signal;
-		unsigned long signr = jobctl & JOBCTL_STOP_SIGMASK;
-		unsigned long gstop = JOBCTL_STOP_PENDING | JOBCTL_STOP_CONSUME;
-		if (task_set_jobctl_pending(task, signr | gstop)) {
-			sig->group_stop_count++;
-		}
-	}
+	task_set_jobctl_pending(task, mask | JOBCTL_STOP_PENDING);
 }
 
 /*