• Oleg Nesterov's avatar
    exec: do not sleep in TASK_TRACED under ->cred_guard_mutex · a2a8474c
    Oleg Nesterov authored
    Tom Horsley reports that his debugger hangs when it tries to read
    /proc/pid_of_tracee/maps, this happens since
    
    	"mm_for_maps: take ->cred_guard_mutex to fix the race with exec"
    	04b836cbf19e885f8366bccb2e4b0474346c02d
    
    commit in 2.6.31.
    
    But the root of the problem lies in the fact that do_execve() path calls
    tracehook_report_exec() which can stop if the tracer sets PT_TRACE_EXEC.
    
    The tracee must not sleep in TASK_TRACED holding this mutex.  Even if we
    remove ->cred_guard_mutex from mm_for_maps() and proc_pid_attr_write(),
    another task doing PTRACE_ATTACH should not hang until it is killed or the
    tracee resumes.
    
    With this patch do_execve() does not use ->cred_guard_mutex directly and
    we do not hold it throughout, instead:
    
    	- introduce prepare_bprm_creds() helper, it locks the mutex
    	  and calls prepare_exec_creds() to initialize bprm->cred.
    
    	- install_exec_creds() drops the mutex after commit_creds(),
    	  and thus before tracehook_report_exec()->ptrace_stop().
    
    	  or, if exec fails,
    
    	  free_bprm() drops this mutex when bprm->cred != NULL which
    	  indicates install_exec_creds() was not called.
    Reported-by: default avatarTom Horsley <tom.horsley@att.net>
    Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
    Acked-by: default avatarDavid Howells <dhowells@redhat.com>
    Cc: Roland McGrath <roland@redhat.com>
    Cc: James Morris <jmorris@namei.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    a2a8474c
binfmts.h 4.11 KB