Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pidfd: refuse access to tasks that have started exiting harder

Browse source 
The recent ptrace fix closed a hole where someone could rely on task->mm
becoming NULL during do_exit() to bypass dumpability checks. This api
here leans on on the very same check and so inherits the fix.

But there is no good reason to let it succeed at all once the target has
entered do_exit(). PF_EXITING is set by exit_signals() at the very top
of do_exit(), before exit_mm() and exit_files() run. Once we observe it,
the task is committed to dying and exit_files() will release the fdtable
shortly.

Fixes: 8649c322f7 ("pid: Implement pidfd_getfd syscall")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260518-obgleich-petersilie-2d77ccccf9b9@brauner
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2026-05-18 10:32:11 +02:00
commit 62c4d31d78
No known key found for this signature in database
GPG key ID: 91C61BC06578DCA2
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
kernel/pid.c
View file

@ -885,10 +885,12 @@ static struct file *__pidfd_fget(struct task_struct *task, int fd)
if (ret) if (ret)
return ERR_PTR(ret); return ERR_PTR(ret);
if (ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS)) if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS))
file = fget_task(task, fd);
else
file = ERR_PTR(-EPERM); file = ERR_PTR(-EPERM);
else if (task->flags & PF_EXITING)
file = ERR_PTR(-ESRCH);
else
file = fget_task(task, fd);
up_read(&task->signal->exec_update_lock); up_read(&task->signal->exec_update_lock);