Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754932AbdDDVxS (ORCPT ); Tue, 4 Apr 2017 17:53:18 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:33564 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754626AbdDDVxQ (ORCPT ); Tue, 4 Apr 2017 17:53:16 -0400 Date: Tue, 4 Apr 2017 14:53:10 -0700 From: Andrew Morton To: bsegall@google.com Cc: Oleg Nesterov , linux-kernel@vger.kernel.org, Roland McGrath , Tejun Heo Subject: Re: [PATCHv2] ptrace: fix PTRACE_LISTEN race corrupting task->state Message-Id: <20170404145310.1de5e75f0bd916aef812e136@linux-foundation.org> In-Reply-To: References: <20170224163611.GA24902@redhat.com> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 777 Lines: 15 On Tue, 04 Apr 2017 14:47:34 -0700 bsegall@google.com wrote: > In PT_SEIZED + LISTEN mode STOP/CONT signals cause a wakeup against > __TASK_TRACED. If this races with the ptrace_unfreeze_traced at the end > of a PTRACE_LISTEN, this can wake the task /after/ the check against > __TASK_TRACED, but before the reset of state to TASK_TRACED. This causes > it to instead clobber TASK_WAKING, allowing a subsequent wakeup against > TRACED while the task is still on the rq wake_list, corrupting it. The changelog doesn't convey the urgency of the fix. To understand this we'll need to know the user-visible impact of the bug and the likelihood of someone hitting it. Also your suggestion regarding which kernel version(s) should be fixed (and the reasoning) is always valuable.