Re: [PATCH] copy_process: fix CLONE_PARENT && parent_exec_id interaction

[Oleg Nesterov <oleg@redhat.com>]

On 03/02, Linus Torvalds wrote:
> 
> 
> On Mon, 2 Mar 2009, Oleg Nesterov wrote:
> > 
> > I am re-sending this patch simplified to one-liner. If this patch is
> > accepted, I think it makes sense to move the first
> > "p->parent_exec_id = p->self_exec_id" in copy_process() down, under
> > the "else" branch. Just for readability.
> > 
> > Note! This patch doesn't even try to address the original CVE. Let me
> > repeat, I am not the security expert, please correct me. But, unless
> > parent or child change security context (via exec), it is OK to send
> > any ->exit_signal when the child exits.
> > 
> > Comments?
> 
> I think this looks correct and sane. And I agree with your "also move down 
> the "p->parent_exec_id = p->self_exec_id" thing. In fact, I'd agree with 
> it so much that I think it should be part of this patch, just because that 
> not only clarifies the code, but it also makes it more obvious what the 
> real change of this one single _patch_ is.

Agreed, please find v2 below. But I failed to make the comment...

Also, "p->parent_exec_id = current->parent_exec_id" is not really needed
in v2, it was already copied by dup_task_struct(). But I think it is better
to make the code a bit more explicit.

------------------
[PATCH v2] copy_process: fix CLONE_PARENT && parent_exec_id interaction

CLONE_PARENT can fool the ->self_exec_id/parent_exec_id logic. If we
re-use the old parent, we must also re-use ->parent_exec_id to make
sure exit_notify() sees the right ->xxx_exec_id's when the CLONE_PARENT'ed
task exits.

Also, move down the "p->parent_exec_id = p->self_exec_id" thing, to place
two different cases together.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>

--- 6.29-rc3/kernel/fork.c~3_CLONE_PARENT	2009-03-02 20:24:59.000000000 +0100
+++ 6.29-rc3/kernel/fork.c	2009-03-02 22:38:39.000000000 +0100
@@ -1177,10 +1177,6 @@ static struct task_struct *copy_process(
 #endif
 	clear_all_latency_tracing(p);
 
-	/* Our parent execution domain becomes current domain
-	   These must match for thread signalling to apply */
-	p->parent_exec_id = p->self_exec_id;
-
 	/* ok, now we should be set up.. */
 	p->exit_signal = (clone_flags & CLONE_THREAD) ? -1 : (clone_flags & CSIGNAL);
 	p->pdeath_signal = 0;
@@ -1218,10 +1214,13 @@ static struct task_struct *copy_process(
 		set_task_cpu(p, smp_processor_id());
 
 	/* CLONE_PARENT re-uses the old parent */
-	if (clone_flags & (CLONE_PARENT|CLONE_THREAD))
+	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
 		p->real_parent = current->real_parent;
-	else
+		p->parent_exec_id = current->parent_exec_id;
+	} else {
 		p->real_parent = current;
+		p->parent_exec_id = current->self_exec_id;
+	}
 
 	spin_lock(&current->sighand->siglock);