From: Greg Kroah-Hartman Date: Mon, 6 Jun 2022 09:42:21 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v5.10.121~156 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=54dfe74845186c5cc8e2049cfb2d052039c7af4a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: ptrace-reimplement-ptrace_kill-by-always-sending-sigkill.patch ptrace-xtensa-replace-pt_singlestep-with-tif_singlestep.patch --- diff --git a/queue-4.14/ptrace-reimplement-ptrace_kill-by-always-sending-sigkill.patch b/queue-4.14/ptrace-reimplement-ptrace_kill-by-always-sending-sigkill.patch new file mode 100644 index 00000000000..28ad5b3ac93 --- /dev/null +++ b/queue-4.14/ptrace-reimplement-ptrace_kill-by-always-sending-sigkill.patch @@ -0,0 +1,71 @@ +From 6a2d90ba027adba528509ffa27097cffd3879257 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Fri, 29 Apr 2022 09:23:55 -0500 +Subject: ptrace: Reimplement PTRACE_KILL by always sending SIGKILL + +From: Eric W. Biederman + +commit 6a2d90ba027adba528509ffa27097cffd3879257 upstream. + +The current implementation of PTRACE_KILL is buggy and has been for +many years as it assumes it's target has stopped in ptrace_stop. At a +quick skim it looks like this assumption has existed since ptrace +support was added in linux v1.0. + +While PTRACE_KILL has been deprecated we can not remove it as +a quick search with google code search reveals many existing +programs calling it. + +When the ptracee is not stopped at ptrace_stop some fields would be +set that are ignored except in ptrace_stop. Making the userspace +visible behavior of PTRACE_KILL a noop in those case. + +As the usual rules are not obeyed it is not clear what the +consequences are of calling PTRACE_KILL on a running process. +Presumably userspace does not do this as it achieves nothing. + +Replace the implementation of PTRACE_KILL with a simple +send_sig_info(SIGKILL) followed by a return 0. This changes the +observable user space behavior only in that PTRACE_KILL on a process +not stopped in ptrace_stop will also kill it. As that has always +been the intent of the code this seems like a reasonable change. + +Cc: stable@vger.kernel.org +Reported-by: Al Viro +Suggested-by: Al Viro +Tested-by: Kees Cook +Reviewed-by: Oleg Nesterov +Link: https://lkml.kernel.org/r/20220505182645.497868-7-ebiederm@xmission.com +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/step.c | 3 +-- + kernel/ptrace.c | 5 ++--- + 2 files changed, 3 insertions(+), 5 deletions(-) + +--- a/arch/x86/kernel/step.c ++++ b/arch/x86/kernel/step.c +@@ -175,8 +175,7 @@ void set_task_blockstep(struct task_stru + * + * NOTE: this means that set/clear TIF_BLOCKSTEP is only safe if + * task is current or it can't be running, otherwise we can race +- * with __switch_to_xtra(). We rely on ptrace_freeze_traced() but +- * PTRACE_KILL is not safe. ++ * with __switch_to_xtra(). We rely on ptrace_freeze_traced(). + */ + local_irq_disable(); + debugctl = get_debugctlmsr(); +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -1127,9 +1127,8 @@ int ptrace_request(struct task_struct *c + return ptrace_resume(child, request, data); + + case PTRACE_KILL: +- if (child->exit_state) /* already dead */ +- return 0; +- return ptrace_resume(child, request, SIGKILL); ++ send_sig_info(SIGKILL, SEND_SIG_NOINFO, child); ++ return 0; + + #ifdef CONFIG_HAVE_ARCH_TRACEHOOK + case PTRACE_GETREGSET: diff --git a/queue-4.14/ptrace-xtensa-replace-pt_singlestep-with-tif_singlestep.patch b/queue-4.14/ptrace-xtensa-replace-pt_singlestep-with-tif_singlestep.patch new file mode 100644 index 00000000000..647b70c263d --- /dev/null +++ b/queue-4.14/ptrace-xtensa-replace-pt_singlestep-with-tif_singlestep.patch @@ -0,0 +1,83 @@ +From 4a3d2717d140401df7501a95e454180831a0c5af Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Tue, 26 Apr 2022 16:45:37 -0500 +Subject: ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP + +From: Eric W. Biederman + +commit 4a3d2717d140401df7501a95e454180831a0c5af upstream. + +xtensa is the last user of the PT_SINGLESTEP flag. Changing tsk->ptrace in +user_enable_single_step and user_disable_single_step without locking could +potentiallly cause problems. + +So use a thread info flag instead of a flag in tsk->ptrace. Use TIF_SINGLESTEP +that xtensa already had defined but unused. + +Remove the definitions of PT_SINGLESTEP and PT_BLOCKSTEP as they have no more users. + +Cc: stable@vger.kernel.org +Acked-by: Max Filippov +Tested-by: Kees Cook +Reviewed-by: Oleg Nesterov +Link: https://lkml.kernel.org/r/20220505182645.497868-4-ebiederm@xmission.com +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman +--- + arch/xtensa/kernel/ptrace.c | 4 ++-- + arch/xtensa/kernel/signal.c | 4 ++-- + include/linux/ptrace.h | 6 ------ + 3 files changed, 4 insertions(+), 10 deletions(-) + +--- a/arch/xtensa/kernel/ptrace.c ++++ b/arch/xtensa/kernel/ptrace.c +@@ -35,12 +35,12 @@ + + void user_enable_single_step(struct task_struct *child) + { +- child->ptrace |= PT_SINGLESTEP; ++ set_tsk_thread_flag(child, TIF_SINGLESTEP); + } + + void user_disable_single_step(struct task_struct *child) + { +- child->ptrace &= ~PT_SINGLESTEP; ++ clear_tsk_thread_flag(child, TIF_SINGLESTEP); + } + + /* +--- a/arch/xtensa/kernel/signal.c ++++ b/arch/xtensa/kernel/signal.c +@@ -459,7 +459,7 @@ static void do_signal(struct pt_regs *re + /* Set up the stack frame */ + ret = setup_frame(&ksig, sigmask_to_save(), regs); + signal_setup_done(ret, &ksig, 0); +- if (current->ptrace & PT_SINGLESTEP) ++ if (test_thread_flag(TIF_SINGLESTEP)) + task_pt_regs(current)->icountlevel = 1; + + return; +@@ -485,7 +485,7 @@ static void do_signal(struct pt_regs *re + /* If there's no signal to deliver, we just restore the saved mask. */ + restore_saved_sigmask(); + +- if (current->ptrace & PT_SINGLESTEP) ++ if (test_thread_flag(TIF_SINGLESTEP)) + task_pt_regs(current)->icountlevel = 1; + return; + } +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -40,12 +40,6 @@ extern int ptrace_access_vm(struct task_ + #define PT_EXITKILL (PTRACE_O_EXITKILL << PT_OPT_FLAG_SHIFT) + #define PT_SUSPEND_SECCOMP (PTRACE_O_SUSPEND_SECCOMP << PT_OPT_FLAG_SHIFT) + +-/* single stepping state bits (used on ARM and PA-RISC) */ +-#define PT_SINGLESTEP_BIT 31 +-#define PT_SINGLESTEP (1<