• Tejun Heo's avatar
    ptrace: use safer wake up on ptrace_detach() · 01e05e9a
    Tejun Heo authored
    The wake_up_process() call in ptrace_detach() is spurious and not
    interlocked with the tracee state.  IOW, the tracee could be running or
    sleeping in any place in the kernel by the time wake_up_process() is
    called.  This can lead to the tracee waking up unexpectedly which can be
    dangerous.
    
    The wake_up is spurious and should be removed but for now reduce its
    toxicity by only waking up if the tracee is in TRACED or STOPPED state.
    
    This bug can possibly be used as an attack vector.  I don't think it
    will take too much effort to come up with an attack which triggers oops
    somewhere.  Most sleeps are wrapped in condition test loops and should
    be safe but we have quite a number of places where sleep and wakeup
    conditions are expected to be interlocked.  Although the window of
    opportunity is tiny, ptrace can be used by non-privileged users and with
    some loading the window can definitely be extended and exploited.
    Signed-off-by: default avatarTejun Heo <tj@kernel.org>
    Acked-by: default avatarRoland McGrath <roland@redhat.com>
    Acked-by: default avatarOleg Nesterov <oleg@redhat.com>
    Cc: <stable@kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    01e05e9a
ptrace.c 20.2 KB