On Wed, 16 Jan 2019, Kees Cook wrote:
> It's possible that a pid has died before we take the rcu lock, in which
> case we can't walk the ancestry list as it may be detached. Instead, check
> for death first before doing the walk.
>
> Reported-by: syzbot+a9ac39bf55329e206...@syzkaller.appspotmail.com
> Fixes: 2d514487faf1 ("security: Yama LSM")
> Cc: sta...@vger.kernel.org
> Suggested-by: Oleg Nesterov <o...@redhat.com>
> Signed-off-by: Kees Cook <keesc...@chromium.org>
> ---
> James, can you please send this to Linus in your -fixes tree?
Done.
> ---
> security/yama/yama_lsm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c
> index ffda91a4a1aa..02514fe558b4 100644
> --- a/security/yama/yama_lsm.c
> +++ b/security/yama/yama_lsm.c
> @@ -368,7 +368,9 @@ static int yama_ptrace_access_check(struct task_struct
> *child,
> break;
> case YAMA_SCOPE_RELATIONAL:
> rcu_read_lock();
> - if (!task_is_descendant(current, child) &&
> + if (!pid_alive(child))
> + rc = -EPERM;
> + if (!rc && !task_is_descendant(current, child) &&
> !ptracer_exception_found(current, child) &&
> !ns_capable(__task_cred(child)->user_ns,
> CAP_SYS_PTRACE))
> rc = -EPERM;
>
--
James Morris
<jmor...@namei.org>
