powerpc, hw_breakpoints: Fix racy access to ptrace breakpoints

While the tracer accesses ptrace breakpoints, the child task may
concurrently exit due to a SIGKILL and thus release its breakpoints
at the same time. We can then dereference some freed pointers.

To fix this, hold a reference on the child breakpoints before
manipulating them.

Reported-by: Oleg Nesterov <[email protected]>
Signed-off-by: Frederic Weisbecker <[email protected]>
Acked-by: Prasad <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Will Deacon <[email protected]>
Cc: Paul Mundt <[email protected]>
Cc: v2.6.33.. <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
This commit is contained in:
Frederic Weisbecker
2011-04-25 17:33:54 +02:00
parent 87dc669ba2
commit 07fa7a0a8a
+3
View File
@@ -1591,7 +1591,10 @@ long arch_ptrace(struct task_struct *child, long request,
}
case PTRACE_SET_DEBUGREG:
if (ptrace_get_breakpoints(child) < 0)
return -ESRCH;
ret = ptrace_set_debugreg(child, addr, data);
ptrace_put_breakpoints(child);
break;
#ifdef CONFIG_PPC64