2 files changed, 27 insertions, 2 deletions

diff --git a/kernel/cred.c b/kernel/cred.c
index e74ffdc98a92..c73a87a4df13 100644
--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -446,6 +446,15 @@ int commit_creds(struct cred *new)
                 if (task->mm)
                         set_dumpable(task->mm, suid_dumpable);
                 task->pdeath_signal = 0;
+                /*
+                 * If a task drops privileges and becomes nondumpable,
+                 * the dumpability change must become visible before
+                 * the credential change; otherwise, a __ptrace_may_access()
+                 * racing with this change may be able to attach to a task it
+                 * shouldn't be able to attach to (as if the task had dropped
+                 * privileges without becoming nondumpable).
+                 * Pairs with a read barrier in __ptrace_may_access().
+                 */
                 smp_wmb();
         }
 
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 5710d07e67cf..8456b6e2205f 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -324,6 +324,16 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
         return -EPERM;
 ok:
         rcu_read_unlock();
+        /*
+         * If a task drops privileges and becomes nondumpable (through a syscall
+         * like setresuid()) while we are trying to access it, we must ensure
+         * that the dumpability is read after the credentials; otherwise,
+         * we may be able to attach to a task that we shouldn't be able to
+         * attach to (as if the task had dropped privileges without becoming
+         * nondumpable).
+         * Pairs with a write barrier in commit_creds().
+         */
+        smp_rmb();
         mm = task->mm;
         if (mm &&
             ((get_dumpable(mm) != SUID_DUMP_USER) &&
@@ -705,6 +715,10 @@ static int ptrace_peek_siginfo(struct task_struct *child,
         if (arg.nr < 0)
                 return -EINVAL;
 
+        /* Ensure arg.off fits in an unsigned long */
+        if (arg.off > ULONG_MAX)
+                return 0;
+
         if (arg.flags & PTRACE_PEEKSIGINFO_SHARED)
                 pending = &child->signal->shared_pending;
         else
@@ -712,18 +726,20 @@ static int ptrace_peek_siginfo(struct task_struct *child,
 
         for (i = 0; i < arg.nr; ) {
                 kernel_siginfo_t info;
-                s32 off = arg.off + i;
+                unsigned long off = arg.off + i;
+                bool found = false;
 
                 spin_lock_irq(&child->sighand->siglock);
                 list_for_each_entry(q, &pending->list, list) {
                         if (!off--) {
+                                found = true;
                                 copy_siginfo(&info, &q->info);
                                 break;
                         }
                 }
                 spin_unlock_irq(&child->sighand->siglock);
 
-                if (off >= 0) /* beyond the end of the list */
+                if (!found) /* beyond the end of the list */
                         break;
 
 #ifdef CONFIG_COMPAT