From: Greg Kroah-Hartman Date: Fri, 15 May 2026 05:19:30 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v5.10.256~43 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=67aeec115538a191b51ca63ba93b8e3f556eb3db;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: ptrace-slightly-saner-get_dumpable-logic.patch --- diff --git a/queue-5.10/ptrace-slightly-saner-get_dumpable-logic.patch b/queue-5.10/ptrace-slightly-saner-get_dumpable-logic.patch new file mode 100644 index 0000000000..430b069276 --- /dev/null +++ b/queue-5.10/ptrace-slightly-saner-get_dumpable-logic.patch @@ -0,0 +1,109 @@ +From 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Wed, 13 May 2026 11:37:18 -0700 +Subject: ptrace: slightly saner 'get_dumpable()' logic + +From: Linus Torvalds + +commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a upstream. + +The 'dumpability' of a task is fundamentally about the memory image of +the task - the concept comes from whether it can core dump or not - and +makes no sense when you don't have an associated mm. + +And almost all users do in fact use it only for the case where the task +has a mm pointer. + +But we have one odd special case: ptrace_may_access() uses 'dumpable' to +check various other things entirely independently of the MM (typically +explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for +threads that no longer have a VM (and maybe never did, like most kernel +threads). + +It's not what this flag was designed for, but it is what it is. + +The ptrace code does check that the uid/gid matches, so you do have to +be uid-0 to see kernel thread details, but this means that the +traditional "drop capabilities" model doesn't make any difference for +this all. + +Make it all make a *bit* more sense by saying that if you don't have a +MM pointer, we'll use a cached "last dumpability" flag if the thread +ever had a MM (it will be zero for kernel threads since it is never +set), and require a proper CAP_SYS_PTRACE capability to override. + +Reported-by: Qualys Security Advisory +Cc: Oleg Nesterov +Cc: Kees Cook +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/sched.h | 3 +++ + kernel/exit.c | 1 + + kernel/ptrace.c | 22 ++++++++++++++++------ + 3 files changed, 20 insertions(+), 6 deletions(-) + +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -805,6 +805,9 @@ struct task_struct { + */ + unsigned sched_remote_wakeup:1; + ++ /* Save user-dumpable when mm goes away */ ++ unsigned user_dumpable:1; ++ + /* Bit to tell LSMs we're in execve(): */ + unsigned in_execve:1; + unsigned in_iowait:1; +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -528,6 +528,7 @@ static void exit_mm(void) + BUG_ON(mm != current->active_mm); + /* more a memory barrier than a real lock */ + task_lock(current); ++ current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER); + current->mm = NULL; + mmap_read_unlock(mm); + enter_lazy_tlb(mm, current); +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -287,11 +287,24 @@ static bool ptrace_has_cap(struct user_n + return ns_capable(ns, CAP_SYS_PTRACE); + } + ++static bool task_still_dumpable(struct task_struct *task, unsigned int mode) ++{ ++ struct mm_struct *mm = task->mm; ++ if (mm) { ++ if (get_dumpable(mm) == SUID_DUMP_USER) ++ return true; ++ return ptrace_has_cap(mm->user_ns, mode); ++ } ++ ++ if (task->user_dumpable) ++ return true; ++ return ptrace_has_cap(&init_user_ns, mode); ++} ++ + /* Returns 0 on success, -errno on denial. */ + static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + { + const struct cred *cred = current_cred(), *tcred; +- struct mm_struct *mm; + kuid_t caller_uid; + kgid_t caller_gid; + +@@ -352,11 +365,8 @@ ok: + * Pairs with a write barrier in commit_creds(). + */ + smp_rmb(); +- mm = task->mm; +- if (mm && +- ((get_dumpable(mm) != SUID_DUMP_USER) && +- !ptrace_has_cap(mm->user_ns, mode))) +- return -EPERM; ++ if (!task_still_dumpable(task, mode)) ++ return -EPERM; + + return security_ptrace_access_check(task, mode); + } diff --git a/queue-5.10/series b/queue-5.10/series index 336ad3b168..97e267ac62 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -270,3 +270,4 @@ rdma-ocrdma-don-t-null-deref-uctx-on-errors-in-ocrdma_copy_pd_uresp.patch rdma-rxe-reject-unknown-opcodes-before-icrc-processing.patch rdma-vmw_pvrdma-fix-double-free-on-pvrdma_alloc_ucontext-error-path.patch x86-cpu-amd-prevent-improper-isolation-of-shared-resources-in-zen2-s-op-cache.patch +ptrace-slightly-saner-get_dumpable-logic.patch