[PATCH 3.16 195/204] ptrace: change __ptrace_unlink() to clear ->ptrace under ->siglock

[Ben Hutchings]

3.16.52-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Oleg Nesterov <o...@redhat.com>

commit 1333ab03150478df8d6f5673a91df1e50dc6ab97 upstream.

This test-case (simplified version of generated by syzkaller)

        #include <unistd.h>
        #include <sys/ptrace.h>
        #include <sys/wait.h>

        void test(void)
        {
                for (;;) {
                        if (fork()) {
                                wait(NULL);
                                continue;
                        }

                        ptrace(PTRACE_SEIZE, getppid(), 0, 0);
                        ptrace(PTRACE_INTERRUPT, getppid(), 0, 0);
                        _exit(0);
                }
        }

        int main(void)
        {
                int np;

                for (np = 0; np < 8; ++np)
                        if (!fork())
                                test();

                while (wait(NULL) > 0)
                        ;
                return 0;
        }

triggers the 2nd WARN_ON_ONCE(!signr) warning in do_jobctl_trap().  The
problem is that __ptrace_unlink() clears task->jobctl under siglock but
task->ptrace is cleared without this lock held; this fools the "else"
branch which assumes that !PT_SEIZED means PT_PTRACED.

Note also that most of other PTRACE_SEIZE checks can race with detach
from the exiting tracer too.  Say, the callers of ptrace_trap_notify()
assume that SEIZED can't go away after it was checked.

Signed-off-by: Oleg Nesterov <o...@redhat.com>
Reported-by: Dmitry Vyukov <dvyu...@google.com>
Cc: Tejun Heo <t...@kernel.org>
Cc: syzkaller <syzkal...@googlegroups.com>
Signed-off-by: Andrew Morton <a...@linux-foundation.org>
Signed-off-by: Linus Torvalds <torva...@linux-foundation.org>
Signed-off-by: Ben Hutchings <b...@decadent.org.uk>
---
 kernel/ptrace.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -79,12 +79,11 @@ void __ptrace_unlink(struct task_struct
 {
        BUG_ON(!child->ptrace);
 
-       child->ptrace = 0;
        child->parent = child->real_parent;
        list_del_init(&child->ptrace_entry);
 
        spin_lock(&child->sighand->siglock);
-
+       child->ptrace = 0;
        /*
         * Clear all pending traps and TRAPPING.  TRAPPING should be
         * cleared regardless of JOBCTL_STOP_PENDING.  Do it explicitly.