From:   ebiederm@xmission.com (Eric W. Biederman)
To:     Vladimir Divjak <vladimir.divjak@bmw.de>
Cc:     <oleg@redhat.com>, <jnewsome@torproject.org>, <tglx@linutronix.de>,
        <akpm@linux-foundation.org>, <asml.silence@gmail.com>,
        <linux-kernel@vger.kernel.org>
In-Reply-To: <20211122005347.1467288-1-vladimir.divjak@bmw.de> (Vladimir
        Divjak's message of "Mon, 22 Nov 2021 01:53:47 +0100")
References: <20211122005347.1467288-1-vladimir.divjak@bmw.de>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux)
Date:   Mon, 22 Nov 2021 09:02:15 -0600
Message-ID: <875ysknsi0.fsf@email.froward.int.ebiederm.org>
MIME-Version: 1.0
Content-Type: text/plain
Subject: Re: [PATCH] ptrace: exit: re-trigger PTRACE_EVENT_EXIT after coredump finished
Precedence: bulk

Vladimir Divjak <vladimir.divjak@bmw.de> writes:

> Re-trigger PTRACE_EVENT_EXIT
> (if one is requested with PTRACE_SEIZE setting PTRACE_O_TRACEEXIT option)
> for a process being core-dumped, after the coredump is finished.
>
> This enables a potential tracer - coredump user mode helper
> (or any other tracer started after the coredump was initiated)
> to receive the PTRACE_EVENT_EXIT for all threads of the crashing process.
>
> Rationale:
>
> For zapped threads, PTRACE_EVENT_EXIT is triggered early during do_exit(),
> before the point at which they sleep, waiting for
> coredump to finish - in exit_mm(), and before a potential
> coredump user mode helper process is launched.
>
> That makes it impossible for the coredump user mode helper process to
> receive PTRACE_EVENT_EXIT events for all threads of the crashing process,
> except for the thread handling the core-dump, which will trigger
> the PTRACE_EVENT_EXIT after the coredump has been finished.

Please test the latest kernel.

The coredump now stops much earlier than exit_mm, and PTRACE_EVENT_EXIT
is after the point the coredump stops.

If you need this functionality on older kernels it should be possible to
backport a subset of my changes without too much trouble

Eric