Bump version to 6.12.0-124.56.4

ptrace: slightly saner get_dumpable() logic

Backport of upstream commit 31e62c2ebbfd ("ptrace: slightly saner
'get_dumpable()' logic") posted by Linus Torvalds in response to a
Qualys Security Advisory. ptrace_may_access() no longer trusts an
absent mm as 'dumpable enough'; mm-less targets (kernel threads,
exited tasks) now require CAP_SYS_PTRACE. A new user_dumpable bit
in task_struct caches the last user-dumpable state of a task whose
mm has been torn down in exit_mm().

Applies to AlmaLinux 10 as-is (offset-only, no fuzz).

1101-ptrace-saner-get_dumpable-logic.patch

@@ -0,0 +1,109 @@
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Subject: [PATCH AlmaLinux 10] ptrace: slightly saner 'get_dumpable()' logic
+
+Backport of upstream commit 31e62c2ebbfd ("ptrace: slightly saner
+'get_dumpable()' logic") posted at
+https://github.com/torvalds/linux/commit/31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a
+
+The 'dumpability' of a task is fundamentally about the memory image of
+the task -- the concept comes from whether it can core dump or not --
+and makes no sense when you don't have an associated mm.
+
+And almost all users do in fact use it only for the case where the
+task has a mm pointer.
+
+But we have one odd special case: ptrace_may_access() uses 'dumpable'
+to check various other things entirely independently of the MM
+(typically explicitly using flags like PTRACE_MODE_READ_FSCREDS).
+Including for threads that no longer have a VM (and maybe never did,
+like most kernel threads).
+
+The ptrace code does check that the uid/gid matches, so you do have
+to be uid-0 to see kernel thread details, but this means that the
+traditional "drop capabilities" model doesn't make any difference
+for this all.
+
+Make it all make a bit more sense by saying that if you don't have a
+MM pointer, we use a cached "last dumpability" flag if the thread
+ever had a MM (it will be zero for kernel threads since it is never
+set), and require a proper CAP_SYS_PTRACE capability to override.
+
+Verified to apply with `patch -p1 -F0` (no offset, no fuzz, no rejects)
+against kernel-6.12.0-124.56.1.el10_1.
+
+Reported-by: Qualys Security Advisory <qsa@qualys.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: Kees Cook <kees@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ include/linux/sched.h |  3 +++
+ kernel/exit.c         |  1 +
+ kernel/ptrace.c       | 22 ++++++++++++++++------
+ 3 files changed, 20 insertions(+), 6 deletions(-)
+
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1007,6 +1007,9 @@ struct task_struct {
+ 	unsigned			sched_rt_mutex:1;
+ #endif
+
++	/* Save user-dumpable when mm goes away */
++	unsigned			user_dumpable:1;
++
+ 	/* Bit to tell TOMOYO we're in execve(): */
+ 	unsigned			in_execve:1;
+ 	unsigned			in_iowait:1;
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -561,6 +561,7 @@ static void exit_mm(void)
+ 	 */
+ 	smp_mb__after_spinlock();
+ 	local_irq_disable();
++	current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER);
+ 	current->mm = NULL;
+ 	membarrier_update_current_mm(NULL);
+ 	enter_lazy_tlb(mm, current);
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -272,11 +272,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode)
+ 	return ns_capable(ns, CAP_SYS_PTRACE);
+ }
+
++static bool task_still_dumpable(struct task_struct *task, unsigned int mode)
++{
++	struct mm_struct *mm = task->mm;
++	if (mm) {
++		if (get_dumpable(mm) == SUID_DUMP_USER)
++			return true;
++		return ptrace_has_cap(mm->user_ns, mode);
++	}
++
++	if (task->user_dumpable)
++		return true;
++	return ptrace_has_cap(&init_user_ns, mode);
++}
++
+ /* Returns 0 on success, -errno on denial. */
+ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ {
+ 	const struct cred *cred = current_cred(), *tcred;
+-	struct mm_struct *mm;
+ 	kuid_t caller_uid;
+ 	kgid_t caller_gid;
+
+@@ -337,11 +350,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ 	 * Pairs with a write barrier in commit_creds().
+ 	 */
+ 	smp_rmb();
+-	mm = task->mm;
+-	if (mm &&
+-	    ((get_dumpable(mm) != SUID_DUMP_USER) &&
+-	     !ptrace_has_cap(mm->user_ns, mode)))
+-	    return -EPERM;
++	if (!task_still_dumpable(task, mode))
++		return -EPERM;
+
+ 	return security_ptrace_access_check(task, mode);
+ }
+--
+2.43.0

kernel.spec

@@ -176,13 +176,13 @@ Summary: The Linux kernel
 %define specrpmversion 6.12.0
 %define specversion 6.12.0
 %define patchversion 6.12
-%define pkgrelease 124.56.3
+%define pkgrelease 124.56.4
 %define kversion 6
 %define tarfile_release 6.12.0-124.56.1.el10_1
 # This is needed to do merge window version magic
 %define patchlevel 12
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 124.56.3%{?buildid}%{?dist}
+%define specrelease 124.56.4%{?buildid}%{?dist}
 # This defines the kabi tarball version
 %define kabiversion 6.12.0-124.56.1.el10_1
 
@@ -1129,6 +1129,7 @@ Patch2008: 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch
 Patch2009: 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch
 Patch2010: 0010-Bring-back-deprecated-pci-ids-to-aacraid-driver.patch
 Patch1100: 1100-net-skbuff-propagate-shared-frag-marker.patch
+Patch1101: 1101-ptrace-saner-get_dumpable-logic.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -1991,6 +1992,7 @@ ApplyPatch 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch
 ApplyPatch 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch
 ApplyPatch 0010-Bring-back-deprecated-pci-ids-to-aacraid-driver.patch
 ApplyPatch 1100-net-skbuff-propagate-shared-frag-marker.patch
+ApplyPatch 1101-ptrace-saner-get_dumpable-logic.patch
 
 %{log_msg "End of patch applications"}
 # END OF PATCH APPLICATIONS
@@ -4379,6 +4381,9 @@ fi\
 #
 #
 %changelog
+* Fri May 15 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-124.56.4
+- ptrace: slightly saner get_dumpable() logic (upstream 31e62c2ebbfd)
+
 * Thu May 14 2026 Eduard Abdullin <eabdullin@almalinux.org> - 6.12.0-124.56.3
 - net: skbuff: propagate shared-frag marker through frag-transfer helpers