linux-stable-rt/kernel
Oleg Nesterov 788e05a67c [PATCH] fix do_coredump() vs SIGSTOP race
Let's suppose we have 2 threads in thread group:
	A - does coredump
	B - has pending SIGSTOP

thread A						thread B

do_coredump:						get_signal_to_deliver:

  lock(->sighand)
  ->signal->flags = SIGNAL_GROUP_EXIT
  unlock(->sighand)

							lock(->sighand)
							signr = dequeue_signal()
								->signal->flags |= SIGNAL_STOP_DEQUEUED
								return SIGSTOP;

							do_signal_stop:
							    unlock(->sighand)

  coredump_wait:

      zap_threads:
          lock(tasklist_lock)
          send SIGKILL to B
              // signal_wake_up() does nothing
          unlock(tasklist_lock)

							    lock(tasklist_lock)
							    lock(->sighand)
							    re-check sig->flags & SIGNAL_STOP_DEQUEUED, yes
							    set_current_state(TASK_STOPPED);
							    finish_stop:
							        schedule();
							            // ->state == TASK_STOPPED

      wait_for_completion(&startup_done)
         // waits for complete() from B,
         // ->state == TASK_UNINTERRUPTIBLE

We can't wake up 'B' in any way:

	SIGCONT will be ignored because handle_stop_signal() sees
	->signal->flags & SIGNAL_GROUP_EXIT.

	sys_kill(SIGKILL)->__group_complete_signal() will choose
	uninterruptible 'A', so it can't help.

	sys_tkill(B, SIGKILL) will be ignored by specific_send_sig_info()
	because B already has pending SIGKILL.

This scenario is not possbile if 'A' does do_group_exit(), because
it sets sig->flags = SIGNAL_GROUP_EXIT and delivers SIGKILL to
subthreads atomically, holding both tasklist_lock and sighand->lock.
That means that do_signal_stop() will notice !SIGNAL_STOP_DEQUEUED
after re-locking ->sighand. And it is not possible to any other
thread to re-add SIGNAL_STOP_DEQUEUED later, because dequeue_signal()
can only return SIGKILL.

I think it is better to change do_coredump() to do sigaddset(SIGKILL)
and signal_wake_up() under sighand->lock, but this patch is much
simpler.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-10-08 14:53:31 -07:00
..
irq
power [PATCH] swsusp: avoid problems if there are too many pages to save 2005-09-28 07:46:41 -07:00
Kconfig.hz
Kconfig.preempt
Makefile
acct.c
audit.c Merge master.kernel.org:/pub/scm/linux/kernel/git/dwmw2/audit-2.6 2005-09-13 09:47:30 -07:00
auditsc.c
capability.c
compat.c
configs.c
cpu.c
cpuset.c [PATCH] cpuset crapectomy 2005-09-30 08:42:24 -07:00
crash_dump.c
dma.c
exec_domain.c
exit.c Fix inequality comparison against "task->state" 2005-10-01 11:04:18 -07:00
extable.c
fork.c [PATCH] CPU hotplug breaks wake_up_new_task 2005-09-17 11:49:59 -07:00
futex.c
intermodule.c
itimer.c
kallsyms.c
kexec.c
kfifo.c
kmod.c
kprobes.c
ksysfs.c
kthread.c
module.c [PATCH] use add_taint() for setting tainted bit flags 2005-09-13 08:22:29 -07:00
panic.c
params.c [PATCH] Ignore trailing whitespace on kernel parameters correctly 2005-09-28 07:46:41 -07:00
pid.c
posix-cpu-timers.c
posix-timers.c
printk.c [PATCH] Add printk_clock() 2005-09-21 10:11:54 -07:00
profile.c
ptrace.c
rcupdate.c
resource.c
sched.c [PATCH] Fix spinlock owner debugging 2005-09-13 09:59:04 -07:00
seccomp.c
signal.c [PATCH] fix do_coredump() vs SIGSTOP race 2005-10-08 14:53:31 -07:00
softirq.c [PATCH] x86-64: Some cleanup and optimization to the processor data area. 2005-09-12 10:49:58 -07:00
softlockup.c
spinlock.c
stop_machine.c
sys.c [PATCH] reboot: comment and factor the main reboot functions 2005-09-22 22:17:33 -07:00
sys_ni.c
sysctl.c
time.c
timer.c [PATCH] schedule_timeout_[un]interruptible() speedup 2005-09-13 08:22:29 -07:00
uid16.c
user.c
wait.c
workqueue.c