ptrace_stop: fix the race with ptrace detach+attach

If the tracer went away (may_ptrace_stop() failed), ptrace_stop() drops
tasklist and then changes the ->state from TASK_TRACED to TASK_RUNNING.

This can fool another tracer which attaches to us in between.  Change the
->state under tasklist_lock to ensure that ptrace_check_attach() can't wrongly
succeed.  Also, remove the unnecessary mb().

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Acked-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/kernel/signal.c b/kernel/signal.c
index 6d6d1ab39e7e3f7dbeea0800a59e336bf4865137..678bffa437c1fceae1e0da4132db5950f0534b8e 100644 (file)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1638,11 +1638,11 @@ static void ptrace_stop(int exit_code, int nostop_code, siginfo_t *info)
        } else {
                /*
                 * By the time we got the lock, our tracer went away.
-                * Don't stop here.
+                * Don't drop the lock yet, another tracer may come.
                 */
-               read_unlock(&tasklist_lock);
-               set_current_state(TASK_RUNNING);
+               __set_current_state(TASK_RUNNING);
                current->exit_code = nostop_code;
+               read_unlock(&tasklist_lock);
        }
 
        /*