[PATCH] copy_process: fix CLONE_PARENT && parent_exec_idinteraction

[Oleg Nesterov]

On 02/26, Oleg Nesterov wrote:
>
> I sent another patch, perhaps someone can comment. Or suggest something
> else.

Nobody commented ;)

I am re-sending this patch simplified to one-liner. If this patch is
accepted, I think it makes sense to move the first
"p->parent_exec_id = p->self_exec_id" in copy_process() down, under
the "else" branch. Just for readability.

Note! This patch doesn't even try to address the original CVE. Let me
repeat, I am not the security expert, please correct me. But, unless
parent or child change security context (via exec), it is OK to send
any ->exit_signal when the child exits.

Comments?

----------------------------------------------------------------------
[PATCH] copy_process: fix CLONE_PARENT && parent_exec_id interaction

CLONE_PARENT can fool the ->self_exec_id/parent_exec_id logic. If we
re-use the old parent, we must also re-use ->parent_exec_id to make
sure exit_notify() sees the right ->xxx_exec_id's when the CLONE_PARENT'ed
task exits.

Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>

--- 6.29-rc3/kernel/fork.c~3_CLONE_PARENT	2009-03-02 20:24:59.000000000 +0100
+++ 6.29-rc3/kernel/fork.c	2009-03-02 21:45:45.000000000 +0100
@@ -1218,9 +1218,10 @@ static struct task_struct *copy_process(
 		set_task_cpu(p, smp_processor_id());
 
 	/* CLONE_PARENT re-uses the old parent */
-	if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
 		p->real_parent = current->real_parent;
-	else
+		p->parent_exec_id = current->parent_exec_id;
+	} else
 		p->real_parent = current;
 
 	spin_lock(&current->sighand->siglock);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/