Commit ed5d2cac authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

exec: rework the group exit and fix the race with kill 



As Roland pointed out, we have the very old problem with exec.  de_thread()
sets SIGNAL_GROUP_EXIT, kills other threads, changes ->group_leader and then
clears signal->flags.  All signals (even fatal ones) sent in this window
(which is not too small) will be lost.

With this patch exec doesn't abuse SIGNAL_GROUP_EXIT.  signal_group_exit(),
the new helper, should be used to detect exit_group() or exec() in progress.
It can have more users, but this patch does only strictly necessary changes.

Signed-off-by: default avatarOleg Nesterov <oleg@tv-sign.ru>
Cc: Davide Libenzi <davidel@xmailserver.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Robin Holt <holt@sgi.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent f558b7e4

fs/exec.c

+4 −9
Original line number Diff line number Diff line
@@ -760,7 +760,7 @@ static int de_thread(struct task_struct *tsk) 
	 */

	read_lock(&tasklist_lock);

	spin_lock_irq(lock);

	if (sig->flags & SIGNAL_GROUP_EXIT) {

	if (signal_group_exit(sig)) {

		/*

		 * Another group action in progress, just

		 * return so that the signal is processed.
@@ -778,6 +778,7 @@ static int de_thread(struct task_struct *tsk) 
	if (unlikely(tsk->group_leader == task_child_reaper(tsk)))

		task_active_pid_ns(tsk)->child_reaper = tsk;



	sig->group_exit_task = tsk;

	zap_other_threads(tsk);

	read_unlock(&tasklist_lock);
@@ -802,7 +803,6 @@ static int de_thread(struct task_struct *tsk) 
	}



	sig->notify_count = count;

	sig->group_exit_task = tsk;

	while (atomic_read(&sig->count) > count) {

		__set_current_state(TASK_UNINTERRUPTIBLE);

		spin_unlock_irq(lock);
@@ -875,11 +875,6 @@ static int de_thread(struct task_struct *tsk) 


	sig->group_exit_task = NULL;

	sig->notify_count = 0;

	/*

	 * There may be one thread left which is just exiting,

	 * but it's safe to stop telling the group to kill themselves.

	 */

	sig->flags = 0;



no_thread_group:

	exit_itimers(sig);
@@ -1549,7 +1544,7 @@ static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm, 
	int err = -EAGAIN;



	spin_lock_irq(&tsk->sighand->siglock);

	if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT)) {

	if (!signal_group_exit(tsk->signal)) {

		tsk->signal->group_exit_code = exit_code;

		zap_process(tsk);

		err = 0;

include/linux/sched.h

+7 −0
Original line number Diff line number Diff line
@@ -555,6 +555,13 @@ struct signal_struct { 
#define SIGNAL_STOP_CONTINUED	0x00000004 /* SIGCONT since WCONTINUED reap */

#define SIGNAL_GROUP_EXIT	0x00000008 /* group exit in progress */



/* If true, all threads except ->group_exit_task have pending SIGKILL */

static inline int signal_group_exit(const struct signal_struct *sig)

{

	return	(sig->flags & SIGNAL_GROUP_EXIT) ||

		(sig->group_exit_task != NULL);

}



/*

 * Some day this will be a full-fledged user tracking system..

 */

kernel/exit.c

+2 −1
Original line number Diff line number Diff line
@@ -1083,11 +1083,12 @@ do_group_exit(int exit_code) 
		struct signal_struct *const sig = current->signal;

		struct sighand_struct *const sighand = current->sighand;

		spin_lock_irq(&sighand->siglock);

		if (sig->flags & SIGNAL_GROUP_EXIT)

		if (signal_group_exit(sig))

			/* Another thread got here before we took the lock.  */

			exit_code = sig->group_exit_code;

		else {

			sig->group_exit_code = exit_code;

			sig->flags = SIGNAL_GROUP_EXIT;

			zap_other_threads(current);

		}

		spin_unlock_irq(&sighand->siglock);

kernel/signal.c

+2 −2
Original line number Diff line number Diff line
@@ -957,7 +957,6 @@ void zap_other_threads(struct task_struct *p) 
{

	struct task_struct *t;



	p->signal->flags = SIGNAL_GROUP_EXIT;

	p->signal->group_stop_count = 0;



	for (t = next_thread(p); t != p; t = next_thread(t)) {
@@ -1697,7 +1696,8 @@ static int do_signal_stop(int signr) 
	} else {

		struct task_struct *t;



		if (!likely(sig->flags & SIGNAL_STOP_DEQUEUED))

		if (!likely(sig->flags & SIGNAL_STOP_DEQUEUED) ||

		    unlikely(sig->group_exit_task))

			return 0;

		/*

		 * There is no group stop already in progress.

CRA Git | Maintained and supported by SUSTech CRA and CCSE