aboutsummaryrefslogtreecommitdiffstats
path: root/fs/exec.c
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@tv-sign.ru>2008-02-05 01:27:24 -0500
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-02-05 12:44:07 -0500
commited5d2cac114202fe2978a9cbcab8f5032796d538 (patch)
treeaa9aaea1aa0945bd9159685d1b04897d105a90c9 /fs/exec.c
parentf558b7e408026eb3c6afcd0e8fc1f7fe31195a6a (diff)
exec: rework the group exit and fix the race with kill
As Roland pointed out, we have the very old problem with exec. de_thread() sets SIGNAL_GROUP_EXIT, kills other threads, changes ->group_leader and then clears signal->flags. All signals (even fatal ones) sent in this window (which is not too small) will be lost. With this patch exec doesn't abuse SIGNAL_GROUP_EXIT. signal_group_exit(), the new helper, should be used to detect exit_group() or exec() in progress. It can have more users, but this patch does only strictly necessary changes. Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Cc: Davide Libenzi <davidel@xmailserver.org> Cc: Ingo Molnar <mingo@elte.hu> Cc: Robin Holt <holt@sgi.com> Cc: Roland McGrath <roland@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/exec.c')
-rw-r--r--fs/exec.c13
1 files changed, 4 insertions, 9 deletions
diff --git a/fs/exec.c b/fs/exec.c
index 966c5c5b6741..be923e4bc389 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -760,7 +760,7 @@ static int de_thread(struct task_struct *tsk)
760 */ 760 */
761 read_lock(&tasklist_lock); 761 read_lock(&tasklist_lock);
762 spin_lock_irq(lock); 762 spin_lock_irq(lock);
763 if (sig->flags & SIGNAL_GROUP_EXIT) { 763 if (signal_group_exit(sig)) {
764 /* 764 /*
765 * Another group action in progress, just 765 * Another group action in progress, just
766 * return so that the signal is processed. 766 * return so that the signal is processed.
@@ -778,6 +778,7 @@ static int de_thread(struct task_struct *tsk)
778 if (unlikely(tsk->group_leader == task_child_reaper(tsk))) 778 if (unlikely(tsk->group_leader == task_child_reaper(tsk)))
779 task_active_pid_ns(tsk)->child_reaper = tsk; 779 task_active_pid_ns(tsk)->child_reaper = tsk;
780 780
781 sig->group_exit_task = tsk;
781 zap_other_threads(tsk); 782 zap_other_threads(tsk);
782 read_unlock(&tasklist_lock); 783 read_unlock(&tasklist_lock);
783 784
@@ -802,7 +803,6 @@ static int de_thread(struct task_struct *tsk)
802 } 803 }
803 804
804 sig->notify_count = count; 805 sig->notify_count = count;
805 sig->group_exit_task = tsk;
806 while (atomic_read(&sig->count) > count) { 806 while (atomic_read(&sig->count) > count) {
807 __set_current_state(TASK_UNINTERRUPTIBLE); 807 __set_current_state(TASK_UNINTERRUPTIBLE);
808 spin_unlock_irq(lock); 808 spin_unlock_irq(lock);
@@ -871,15 +871,10 @@ static int de_thread(struct task_struct *tsk)
871 leader->exit_state = EXIT_DEAD; 871 leader->exit_state = EXIT_DEAD;
872 872
873 write_unlock_irq(&tasklist_lock); 873 write_unlock_irq(&tasklist_lock);
874 } 874 }
875 875
876 sig->group_exit_task = NULL; 876 sig->group_exit_task = NULL;
877 sig->notify_count = 0; 877 sig->notify_count = 0;
878 /*
879 * There may be one thread left which is just exiting,
880 * but it's safe to stop telling the group to kill themselves.
881 */
882 sig->flags = 0;
883 878
884no_thread_group: 879no_thread_group:
885 exit_itimers(sig); 880 exit_itimers(sig);
@@ -1549,7 +1544,7 @@ static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
1549 int err = -EAGAIN; 1544 int err = -EAGAIN;
1550 1545
1551 spin_lock_irq(&tsk->sighand->siglock); 1546 spin_lock_irq(&tsk->sighand->siglock);
1552 if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT)) { 1547 if (!signal_group_exit(tsk->signal)) {
1553 tsk->signal->group_exit_code = exit_code; 1548 tsk->signal->group_exit_code = exit_code;
1554 zap_process(tsk); 1549 zap_process(tsk);
1555 err = 0; 1550 err = 0;