[PATCH 58] do_ptrace_notify_stop: fix the race with SIGKILL

[Oleg Nesterov]

do_ptrace_notify_stop()->do_notify_parent_cldstop() is not safe
when called by tracer.

By the time we take tasklist the tracee can be SIGKILL'ed and
released by our sub-thread. In this case it is wrong to notify
its ->real_parent.

If ->real_parent has exited, then do_notify_parent_cldstop()
can use the freed/unmapped/resused/ task_struct.

Check task_ptrace(tracee) under tasklist_lock.

---

 kernel/ptrace.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- PU/kernel/ptrace.c~58_NOTIFY_FIX_RACE	2009-10-02 23:19:41.000000000 +0200
+++ PU/kernel/ptrace.c	2009-10-02 23:34:57.000000000 +0200
@@ -831,14 +831,15 @@ static void do_ptrace_notify_stop(struct
 	WARN_ON(!context->ev_code);
 	context->ev_code = 0;
 
-	// XXX: !!!!!!!! UNSAFE when called by tracer !!!!!!!!!!!!!
 	read_lock(&tasklist_lock);
 	/*
 	 * Don't want to allow preemption here, because
 	 * sys_ptrace() needs this task to be inactive.
 	 */
 	preempt_disable();
-	do_notify_parent_cldstop(tracee, CLD_TRAPPED);
+	/* It can be killed and then released by our subthread */
+	if (task_ptrace(tracee))
+		do_notify_parent_cldstop(tracee, CLD_TRAPPED);
 	read_unlock(&tasklist_lock);
 	preempt_enable_no_resched();
 }