[RFC PATCH 12/24] fork: let kernel callers create embryonic tasks
From: Li Chen <hidden>
Date: 2026-07-16 14:39:35
Also in:
linux-arch, linux-doc, linux-fsdevel, linux-kselftest, linux-mm, linux-security-module, lkml
Subsystem:
exec & binfmt api, elf, memory management - core, ptrace support, scheduler, the rest · Maintainers:
Kees Cook, Andrew Morton, David Hildenbrand, Oleg Nesterov, Ingo Molnar, Peter Zijlstra, Juri Lelli, Vincent Guittot, Linus Torvalds
A kernel-created task can become visible before it has installed a new executable image or a valid userspace register frame. Exposing such a task through ptrace can disclose kernel setup state. Add a task-local embryonic flag and an internal clone argument for callers that need this lifecycle. Reject ptrace access until the creator clears the flag. Clear it with release ordering and observe it with acquire ordering. This orders visibility of the completed exec state with the transition. Existing fork, vfork, clone, and kernel-thread callers leave the argument unset and retain their current behavior. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Li Chen <redacted> --- include/linux/sched.h | 21 +++++++++++++++++++++ include/linux/sched/task.h | 1 + kernel/fork.c | 1 + kernel/ptrace.c | 4 ++++ 4 files changed, 27 insertions(+)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 908aff695ef86..031ae92884c3c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h@@ -1863,6 +1863,7 @@ static __always_inline bool is_user_task(struct task_struct *task) #define PFA_SPEC_IB_DISABLE 5 /* Indirect branch speculation restricted */ #define PFA_SPEC_IB_FORCE_DISABLE 6 /* Indirect branch speculation permanently restricted */ #define PFA_SPEC_SSB_NOEXEC 7 /* Speculative Store Bypass clear on execve() */ +#define PFA_EMBRYONIC_EXEC 8 /* No valid user register frame */ #define TASK_PFA_TEST(name, func) \ static inline bool task_##func(struct task_struct *p) \
@@ -1905,6 +1906,26 @@ TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable) TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable) TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable) +/* Clearing this bit publishes the register and security state from exec. */ +static inline bool task_is_embryonic_exec(struct task_struct *p) +{ + return test_bit_acquire(PFA_EMBRYONIC_EXEC, &p->atomic_flags); +} + +/* The task is private during copy_process(), so no publication barrier. */ +static inline void task_init_embryonic_exec(struct task_struct *p, bool set) +{ + if (set) + __set_bit(PFA_EMBRYONIC_EXEC, &p->atomic_flags); + else + __clear_bit(PFA_EMBRYONIC_EXEC, &p->atomic_flags); +} + +static inline void task_clear_embryonic_exec(struct task_struct *p) +{ + clear_bit_unlock(PFA_EMBRYONIC_EXEC, &p->atomic_flags); +} + static inline void current_restore_flags(unsigned long orig_flags, unsigned long flags) {
diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
index 92b4e3bc31e66..5b7facf12b33b 100644
--- a/include/linux/sched/task.h
+++ b/include/linux/sched/task.h@@ -45,6 +45,7 @@ struct kernel_clone_args { void *fn_arg; struct cgroup *cgrp; struct css_set *cset; + bool embryonic_exec; unsigned int kill_seq; };
diff --git a/kernel/fork.c b/kernel/fork.c
index d16405c037c2f..e3ade83b2d4e2 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c@@ -2138,6 +2138,7 @@ __latent_entropy struct task_struct *copy_process( retval = copy_exec_state(clone_flags, p); if (retval) goto bad_fork_free; + task_init_embryonic_exec(p, args->embryonic_exec); p->flags &= ~PF_KTHREAD; if (args->kthread) p->flags |= PF_KTHREAD;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index d041645d9d17d..36eb9b154a397 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c@@ -56,6 +56,8 @@ bool ptracer_access_allowed(struct task_struct *tsk) guard(rcu)(); if (ptrace_parent(tsk) != current) return false; + if (task_is_embryonic_exec(tsk)) + return false; es = task_exec_state_rcu(tsk); return READ_ONCE(es->dumpable) == TASK_DUMPABLE_OWNER || ptracer_capable(tsk, es->user_ns);
@@ -312,6 +314,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n"); return -EPERM; } + if (task_is_embryonic_exec(task)) + return -EPERM; /* May we inspect the given task? * This check is used both for attaching with ptrace
--
2.52.0