Skip to contentSkip to conversation

ptrace patch fails stress testing

DISCUSSION James Cownie 2 participants 2 messages Apr 3, 2003

lore
Share & tools
lore

James Cownie

author
#0 lore raw

Alan wrote :-

Quoted 11 lines · On Tue, 2003-04-01 at 19:22, [email protected] wrote:
Quoted 7 lines

The problem appears to be that task->mm is dereferenced without looking to see if mm is NULL. e.g. in the sched.h in the is_dumpable() macro, we have task->mm->dumpable . I'm sitting in front of a KDB session and I'm clearly looking at task->mm which is NULL.
Why, how and under what conditions this race condition occurs, I don't know. What the best fix is, I don't know.

Zombie process. The patch checks ->mm but must also check ->mm != NULL first.

We're seeing this 100% reliably with out TotalView debugger, and as Alan suggests it happens when trying to make a ptrace call on a zombie process.

FWIW the oops looks like this

Quoted 1 line
Quoted 1 line

EIP; c01197f3 <ptrace_check_attach+13/50> <=====

Trace; c0109bc6 <sys_ptrace+ba/580>
Trace; c0106cb8 <error_code+34/3c>
Trace; c0106bc7 <system_call+33/38>
Code; c01197f3 <ptrace_check_attach+13/50>
00000000 <_EIP>:
Code; c01197f3 <ptrace_check_attach+13/50> <=====

     0:   f6 40 7c 01               testb  $0x1,0x7c(%eax)   <=====
  Code;  c01197f7 <ptrace_check_attach+17/50>
     4:   75 07                     jne    d <_EIP+0xd> c0119800 <ptrace_check_attach+20/50>
  Code;  c01197f9 <ptrace_check_attach+19/50>
     6:   b8 ff ff ff ff            mov    $0xffffffff,%eax
  Code;  c01197fe <ptrace_check_attach+1e/50>
     b:   c3                        ret    
  Code;  c01197ff <ptrace_check_attach+1f/50>
     c:   90                        nop    
  Code;  c0119800 <ptrace_check_attach+20/50>
     d:   f6 42 18 01               testb  $0x1,0x18(%edx)
  Code;  c0119804 <ptrace_check_attach+24/50>
    11:   75 0a                     jne    1d <_EIP+0x1d> c0119810 <ptrace_check_attach+30/50>
  Code;  c0119806 <ptrace_check_attach+26/50>
    13:   b8 00 00 00 00            mov    $0x0,%eax

which corresponds to checking a null mm.

Following Alan, the fix, then is to have is_dumpable look like this :-

#define is_dumpable(tsk) ((tsk)->task_dumpable && (tsk)->mm && (tsk)->mm->dumpable)

(and be prepared un user space to get EPERM back from some ptrace calls which previously "worked" ok.)

-- Jim

James Cownie <[email protected]>
Etnus, LLC. +44 117 9071438
http://www.etnus.com

#1 lore raw
Quoted 4 lines · * James Cownie ([email protected]) wrote:

We're seeing this 100% reliably with out TotalView debugger, and as Alan suggests it happens when trying to make a ptrace call on a zombie process.

Yup, I can reliably reproduce this as well. I'm also using the same patch in is_dumpable().

thanks,
-chris

Signature · 1 line
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net