[PATCH] ptrace: fix PTRACE_LISTEN race corrupting task->state

[bsegall@google.com]

In PT_SEIZED + LISTEN mode SIGSTOP/SIGCONT signals cause a wakeup
against __TASK_TRACED. If this races with the ptrace_unfreeze_traced at
the end of a PTRACE_LISTEN, this can wake the task /after/ the check
against __TASK_TRACED, but before the reset of state to TASK_TRACED.
This causes it to instead clobber TASK_WAKING, allowing a subsequent
wakeup against TASK_TRACED while the task is still on the rq wake_list,
corrupting it.

Signed-off-by: Ben Segall <bsegall@google.com>
---
 kernel/ptrace.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 0af928712174..852d71440ded 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -184,10 +184,14 @@ static void ptrace_unfreeze_traced(struct task_struct *task)
 
        WARN_ON(!task->ptrace || task->parent != current);
 
+       /*
+        * Double check __TASK_TRACED under the lock to prevent corrupting state
+        * in case of a ptrace_trap_notify wakeup
+        */
        spin_lock_irq(&task->sighand->siglock);
        if (__fatal_signal_pending(task))
                wake_up_state(task, __TASK_TRACED);
-       else
+       else if (task->state == __TASK_TRACED)
                task->state = TASK_TRACED;
        spin_unlock_irq(&task->sighand->siglock);
 }
-- 
2.11.0.483.g087da7b7c-goog