In PT_SEIZED + LISTEN mode SIGSTOP/SIGCONT signals cause a wakeup
against __TASK_TRACED. If this races with the ptrace_unfreeze_traced at
the end of a PTRACE_LISTEN, this can wake the task /after/ the check
against __TASK_TRACED, but before the reset of state to TASK_TRACED.
This causes it to instead clobber TASK_WAKING, allowing a subsequent
wakeup against TASK_TRACED while the task is still on the rq wake_list,
corrupting it.
Signed-off-by: Ben Segall <bseg...@google.com>
---
kernel/ptrace.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 0af928712174..852d71440ded 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -184,10 +184,14 @@ static void ptrace_unfreeze_traced(struct task_struct
*task)
WARN_ON(!task->ptrace || task->parent != current);
+ /*
+ * Double check __TASK_TRACED under the lock to prevent corrupting state
+ * in case of a ptrace_trap_notify wakeup
+ */
spin_lock_irq(&task->sighand->siglock);
if (__fatal_signal_pending(task))
wake_up_state(task, __TASK_TRACED);
- else
+ else if (task->state == __TASK_TRACED)
task->state = TASK_TRACED;
spin_unlock_irq(&task->sighand->siglock);
}
--
2.11.0.483.g087da7b7c-goog
