ptrace: ptrace_detach() can no longer race with SIGKILL (64a4096c) · Commits · 戴 / test

ptrace_detach() re-checks ->ptrace under tasklist lock and calls release_task() if __ptrace_detach() returns true. This was needed because the __TASK_TRACED tracee could be killed/untraced, and it could even pass exit_notify() before we take tasklist_lock. But this is no longer possible after "ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL". We can turn these checks into WARN_ON() and remove release_task(). While at it, document the setting of child->exit_code. Signed-off-by:

Oleg Nesterov <oleg@redhat.com> Cc: Pavel Labath <labath@google.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

kernel/ptrace.c

+9 −10

Original line number	Diff line number	Diff line
		@@ -456,8 +456,6 @@ static bool __ptrace_detach(struct task_struct tracer, struct task_struct p)

		static int ptrace_detach(struct task_struct *child, unsigned int data)
		{
		bool dead = false;

		if (!valid_signal(data))
		return -EIO;

		@@ -467,18 +465,19 @@ static int ptrace_detach(struct task_struct *child, unsigned int data)

		write_lock_irq(&tasklist_lock);
		/*
		* This child can be already killed. Make sure de_thread() or
		* our sub-thread doing do_wait() didn't do release_task() yet.
		* We rely on ptrace_freeze_traced(). It can't be killed and
		* untraced by another thread, it can't be a zombie.
		*/
		WARN_ON(!child->ptrace \|\| child->exit_state);
		/*
		* tasklist_lock avoids the race with wait_task_stopped(), see
		* the comment in ptrace_resume().
		*/
		if (child->ptrace) {
		child->exit_code = data;
		dead = __ptrace_detach(current, child);
		}
		__ptrace_detach(current, child);
		write_unlock_irq(&tasklist_lock);

		proc_ptrace_connector(child, PTRACE_DETACH);
		if (unlikely(dead))
		release_task(child);

		return 0;
		}

Admin message