ptrace: clear TIF_SYSCALL_TRACE on ptrace detach

On __ptrace_detach(), called from do_exit()->exit_notify()-> forget_original_parent()->exit_ptrace(), the TIF_SYSCALL_TRACE in thread->flags of the tracee is not cleared up. This results in the tracehook_report_syscall_* being called (though there's no longer a tracer listening to that) upon its further syscalls. Example scenario - attach "strace" to a running process and kill it (the strace) with SIGKILL. You'll see that the syscall trace hooks are still being called. The clearing of this flag should be moved from ptrace_detach() to __ptrace_detach().

Ales Novak committed 10 years ago

Commit 0a5bf401 parent 086e7741 file · +2 −1Browse files

Showing the changes to kernel (1 of 1 file). Show all

Unified · Split

kernel/ptrace.c+2−1

@@ -73,6 +73,8 @@ void __ptrace_unlink(struct task_struct *child) · 72 unmodified lines
73	73	{
74	74	BUG_ON(!child->ptrace);
75	75
	76	+ clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
	77	+
76	78	child->parent = child->real_parent;
77	79	list_del_init(&child->ptrace_entry);
78	80
@@ -489,7 +491,6 @@ static int ptrace_detach(struct task_struct *child, unsigned int data) · 410 unmodified lines
489	491
490	492	/* Architecture-specific hardware disable .. */
491	493	ptrace_disable(child);
492		− clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);
493	494
494	495	write_lock_irq(&tasklist_lock);
495	496	/*