Fix atomicity of TIF update in flush_thread() for x86_64
PATCH 1/1 Fix atomicity of TIF update in flush_thread() for x86_64
Fix atomicity of TIF update in flush_thread() for x86_64
Race :
parent process executing :sys_ptrace()
(lock_kernel())
(ptrace_get_task_struct(pid))
arch_ptrace()
ptrace_detach()
ptrace_disable(child);
clear_singlestep(child);
clear_tsk_thread_flag(child, TIF_SINGLESTEP);
(which clears the TIF_SINGLESTEP flag atomically from a different
process) (put_task_struct(child))
(unlock_kernel())
And at the same time, in the child process :sys_execve()
do_execve()
search_binary_handler()
load_elf_binary()
flush_old_exec()
flush_thread()
doing a non-atomic thread flag update
It applies on 2.6.20.
arch/x86_64/kernel/process.c +8 -5
@@ -385,14 +385,17 @@ void exit_thread(void)void flush_thread (void ) {struct task_struct *tsk = current; -struct thread_info *t =current_thread_info (); -if (t->flags & _TIF_ABI_PENDING) { - t->flags ^= (_TIF_ABI_PENDING | _TIF_IA32); -if (t->flags & _TIF_IA32) +if (test_tsk_thread_flag (tsk,TIF_ABI_PENDING )) { +clear_tsk_thread_flag (tsk,TIF_ABI_PENDING ); +if (test_tsk_thread_flag (tsk,TIF_IA32 )) { +clear_tsk_thread_flag (tsk,TIF_IA32 ); + }else { +set_tsk_thread_flag (tsk,TIF_IA32 );current_thread_info ()->status |=TS_COMPAT ; + } } - t->flags &= ~_TIF_DEBUG; +clear_tsk_thread_flag (tsk,TIF_DEBUG ); tsk->thread.debugreg0 =0 ; tsk->thread.debugreg1 =0 ;
Signature · 3 lines
Mathieu Desnoyers Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F BA06 3F25 A8FE 3BAE 9A68
From: Mathieu Desnoyers <[email protected]>
Date: Thu, 8 Mar 2007 21:15:53 -0500
Quoted 27 lines
Fix atomicity of TIF update in
flush_thread()forx86_64Race :
parent process executing :
sys_ptrace()
(lock_kernel())
(ptrace_get_task_struct(pid))
arch_ptrace()
ptrace_detach()ptrace_disable(child); clear_singlestep(child); clear_tsk_thread_flag(child, TIF_SINGLESTEP); (which clears the TIF_SINGLESTEP flag atomically from a different process)(
put_task_struct(child))
(unlock_kernel())And at the same time, in the child process :
sys_execve()
do_execve()
search_binary_handler()
load_elf_binary()
flush_old_exec()
flush_thread()
doing a non-atomic thread flag update
Quoted 4 lines
It applies on 2.6.20.
Signed-off-by Rebecca Schultz <[email protected]>Signed-off-by Mathieu Desnoyers <[email protected]>
Please fix all platforms, not just your favorite one, kthx. :-)
Quoted 30 lines · * David Miller ([email protected]) wrote:
From: Mathieu Desnoyers <[email protected]>
Date: Thu, 8 Mar 2007 21:15:53 -0500Quoted 27 lines
Fix atomicity of TIF update in
flush_thread()forx86_64Race :
parent process executing :
sys_ptrace()
(lock_kernel())
(ptrace_get_task_struct(pid))
arch_ptrace()
ptrace_detach()ptrace_disable(child); clear_singlestep(child); clear_tsk_thread_flag(child, TIF_SINGLESTEP); (which clears the TIF_SINGLESTEP flag atomically from a different process)(
put_task_struct(child))
(unlock_kernel())And at the same time, in the child process :
sys_execve()
do_execve()
search_binary_handler()
load_elf_binary()
flush_old_exec()
flush_thread()
doing a non-atomic thread flag update
Quoted 7 lines
Quoted 4 lines
It applies on 2.6.20.
Signed-off-by Rebecca Schultz <[email protected]>Signed-off-by Mathieu Desnoyers <[email protected]>Please fix all platforms, not just your favorite one, kthx. :-)
Please be comprehensive of the speed at which fingers can type on my keyboard. Your quickness at replying to email is impressive though ;)
I am working on it, it won't take long.
Regards,
Mathieu
Signature · 3 lines
Mathieu Desnoyers Computer Engineering Ph.D. Student, Ecole Polytechnique de Montreal OpenPGP key fingerprint: 8CD5 52C3 8E3C 4140 715F BA06 3F25 A8FE 3BAE 9A68