[RFC PATCH 12/24] fork: let kernel callers create embryonic tasks

From: Li Chen <hidden>
Date: 2026-07-16 14:39:35
Also in: linux-arch, linux-doc, linux-fsdevel, linux-kselftest, linux-mm, linux-security-module, lkml
Reply to: Li Chen, 2026-07-16

A kernel-created task can become visible before it has installed a new
executable image or a valid userspace register frame. Exposing such a task
through ptrace can disclose kernel setup state.

Add a task-local embryonic flag and an internal clone argument for callers
that need this lifecycle. Reject ptrace access until the creator clears the
flag. Clear it with release ordering and observe it with acquire ordering.
This orders visibility of the completed exec state with the transition.

Existing fork, vfork, clone, and kernel-thread callers leave the argument
unset and retain their current behavior.

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Li Chen <redacted>
---
 include/linux/sched.h      | 21 +++++++++++++++++++++
 include/linux/sched/task.h |  1 +
 kernel/fork.c              |  1 +
 kernel/ptrace.c            |  4 ++++
 4 files changed, 27 insertions(+)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 908aff695ef86..031ae92884c3c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h

@@ -1863,6 +1863,7 @@ static __always_inline bool is_user_task(struct task_struct *task)
 #define PFA_SPEC_IB_DISABLE		5	/* Indirect branch speculation restricted */
 #define PFA_SPEC_IB_FORCE_DISABLE	6	/* Indirect branch speculation permanently restricted */
 #define PFA_SPEC_SSB_NOEXEC		7	/* Speculative Store Bypass clear on execve() */
+#define PFA_EMBRYONIC_EXEC		8	/* No valid user register frame */
 
 #define TASK_PFA_TEST(name, func)					\
 	static inline bool task_##func(struct task_struct *p)		\

@@ -1905,6 +1906,26 @@ TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable)
 TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
 TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
 
+/* Clearing this bit publishes the register and security state from exec. */
+static inline bool task_is_embryonic_exec(struct task_struct *p)
+{
+	return test_bit_acquire(PFA_EMBRYONIC_EXEC, &p->atomic_flags);
+}
+
+/* The task is private during copy_process(), so no publication barrier. */
+static inline void task_init_embryonic_exec(struct task_struct *p, bool set)
+{
+	if (set)
+		__set_bit(PFA_EMBRYONIC_EXEC, &p->atomic_flags);
+	else
+		__clear_bit(PFA_EMBRYONIC_EXEC, &p->atomic_flags);
+}
+
+static inline void task_clear_embryonic_exec(struct task_struct *p)
+{
+	clear_bit_unlock(PFA_EMBRYONIC_EXEC, &p->atomic_flags);
+}
+
 static inline void
 current_restore_flags(unsigned long orig_flags, unsigned long flags)
 {

diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
index 92b4e3bc31e66..5b7facf12b33b 100644
--- a/include/linux/sched/task.h
+++ b/include/linux/sched/task.h

@@ -45,6 +45,7 @@ struct kernel_clone_args {
 	void *fn_arg;
 	struct cgroup *cgrp;
 	struct css_set *cset;
+	bool embryonic_exec;
 	unsigned int kill_seq;
 };

diff --git a/kernel/fork.c b/kernel/fork.c
index d16405c037c2f..e3ade83b2d4e2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c

@@ -2138,6 +2138,7 @@ __latent_entropy struct task_struct *copy_process(
 	retval = copy_exec_state(clone_flags, p);
 	if (retval)
 		goto bad_fork_free;
+	task_init_embryonic_exec(p, args->embryonic_exec);
 	p->flags &= ~PF_KTHREAD;
 	if (args->kthread)
 		p->flags |= PF_KTHREAD;

diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index d041645d9d17d..36eb9b154a397 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c

@@ -56,6 +56,8 @@ bool ptracer_access_allowed(struct task_struct *tsk)
 	guard(rcu)();
 	if (ptrace_parent(tsk) != current)
 		return false;
+	if (task_is_embryonic_exec(tsk))
+		return false;
 	es = task_exec_state_rcu(tsk);
 	return READ_ONCE(es->dumpable) == TASK_DUMPABLE_OWNER ||
 	       ptracer_capable(tsk, es->user_ns);

@@ -312,6 +314,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
 		WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n");
 		return -EPERM;
 	}
+	if (task_is_embryonic_exec(task))
+		return -EPERM;
 
 	/* May we inspect the given task?
 	 * This check is used both for attaching with ptrace

-- 
2.52.0

`h`	back out one level
`j`	next message in thread / next series-diff position
`k`	previous message in thread / previous series-diff position
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help