Commit fec1d011 authored Dec 06, 2006 by Roland McGrath Committed by Linus Torvalds Dec 07, 2006

[PATCH] Disable CLONE_CHILD_CLEARTID for abnormal exit



The CLONE_CHILD_CLEARTID flag is used by NPTL to have its threads
communicate via memory/futex when they exit, so pthread_join can
synchronize using a simple futex wait.  The word of user memory where NPTL
stores a thread's own TID is what it passes; this gets reset to zero at
thread exit.

It is not desireable to touch this user memory when threads are dying due
to a fatal signal.  A core dump is more usefully representative of the
dying program state if the threads live at the time of the crash have their
NPTL data structures unperturbed.  The userland expectation of
CLONE_CHILD_CLEARTID has only ever been that it works for a thread making
an _exit system call.

This problem was identified by Ernie Petrides <petrides@redhat.com>.

Signed-off-by: Roland McGrath <roland@redhat.com>
Cc: Ernie Petrides <petrides@redhat.com>
Cc: Jakub Jelinek <jakub@redhat.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Ulrich Drepper <drepper@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

parent 736c4b85

kernel/fork.c

+10 −1

Original line number	Diff line number	Diff line
		@@ -448,7 +448,16 @@ void mm_release(struct task_struct tsk, struct mm_struct mm)
		tsk->vfork_done = NULL;
		complete(vfork_done);
		}
		if (tsk->clear_child_tid && atomic_read(&mm->mm_users) > 1) {

		/*
		* If we're exiting normally, clear a user-space tid field if
		* requested. We leave this alone when dying by signal, to leave
		* the value intact in a core dump, and to save the unnecessary
		* trouble otherwise. Userland only wants this done for a sys_exit.
		*/
		if (tsk->clear_child_tid
		&& !(tsk->flags & PF_SIGNALED)
		&& atomic_read(&mm->mm_users) > 1) {
		u32 __user * tidptr = tsk->clear_child_tid;
		tsk->clear_child_tid = NULL;

Admin message