diff options
author | Oleg Nesterov <oleg@tv-sign.ru> | 2008-02-05 01:27:24 -0500 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2008-02-05 12:44:07 -0500 |
commit | ed5d2cac114202fe2978a9cbcab8f5032796d538 (patch) | |
tree | aa9aaea1aa0945bd9159685d1b04897d105a90c9 /fs/exec.c | |
parent | f558b7e408026eb3c6afcd0e8fc1f7fe31195a6a (diff) |
exec: rework the group exit and fix the race with kill
As Roland pointed out, we have the very old problem with exec. de_thread()
sets SIGNAL_GROUP_EXIT, kills other threads, changes ->group_leader and then
clears signal->flags. All signals (even fatal ones) sent in this window
(which is not too small) will be lost.
With this patch exec doesn't abuse SIGNAL_GROUP_EXIT. signal_group_exit(),
the new helper, should be used to detect exit_group() or exec() in progress.
It can have more users, but this patch does only strictly necessary changes.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Davide Libenzi <davidel@xmailserver.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Robin Holt <holt@sgi.com>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/exec.c')
-rw-r--r-- | fs/exec.c | 13 |
1 files changed, 4 insertions, 9 deletions
@@ -760,7 +760,7 @@ static int de_thread(struct task_struct *tsk) | |||
760 | */ | 760 | */ |
761 | read_lock(&tasklist_lock); | 761 | read_lock(&tasklist_lock); |
762 | spin_lock_irq(lock); | 762 | spin_lock_irq(lock); |
763 | if (sig->flags & SIGNAL_GROUP_EXIT) { | 763 | if (signal_group_exit(sig)) { |
764 | /* | 764 | /* |
765 | * Another group action in progress, just | 765 | * Another group action in progress, just |
766 | * return so that the signal is processed. | 766 | * return so that the signal is processed. |
@@ -778,6 +778,7 @@ static int de_thread(struct task_struct *tsk) | |||
778 | if (unlikely(tsk->group_leader == task_child_reaper(tsk))) | 778 | if (unlikely(tsk->group_leader == task_child_reaper(tsk))) |
779 | task_active_pid_ns(tsk)->child_reaper = tsk; | 779 | task_active_pid_ns(tsk)->child_reaper = tsk; |
780 | 780 | ||
781 | sig->group_exit_task = tsk; | ||
781 | zap_other_threads(tsk); | 782 | zap_other_threads(tsk); |
782 | read_unlock(&tasklist_lock); | 783 | read_unlock(&tasklist_lock); |
783 | 784 | ||
@@ -802,7 +803,6 @@ static int de_thread(struct task_struct *tsk) | |||
802 | } | 803 | } |
803 | 804 | ||
804 | sig->notify_count = count; | 805 | sig->notify_count = count; |
805 | sig->group_exit_task = tsk; | ||
806 | while (atomic_read(&sig->count) > count) { | 806 | while (atomic_read(&sig->count) > count) { |
807 | __set_current_state(TASK_UNINTERRUPTIBLE); | 807 | __set_current_state(TASK_UNINTERRUPTIBLE); |
808 | spin_unlock_irq(lock); | 808 | spin_unlock_irq(lock); |
@@ -871,15 +871,10 @@ static int de_thread(struct task_struct *tsk) | |||
871 | leader->exit_state = EXIT_DEAD; | 871 | leader->exit_state = EXIT_DEAD; |
872 | 872 | ||
873 | write_unlock_irq(&tasklist_lock); | 873 | write_unlock_irq(&tasklist_lock); |
874 | } | 874 | } |
875 | 875 | ||
876 | sig->group_exit_task = NULL; | 876 | sig->group_exit_task = NULL; |
877 | sig->notify_count = 0; | 877 | sig->notify_count = 0; |
878 | /* | ||
879 | * There may be one thread left which is just exiting, | ||
880 | * but it's safe to stop telling the group to kill themselves. | ||
881 | */ | ||
882 | sig->flags = 0; | ||
883 | 878 | ||
884 | no_thread_group: | 879 | no_thread_group: |
885 | exit_itimers(sig); | 880 | exit_itimers(sig); |
@@ -1549,7 +1544,7 @@ static inline int zap_threads(struct task_struct *tsk, struct mm_struct *mm, | |||
1549 | int err = -EAGAIN; | 1544 | int err = -EAGAIN; |
1550 | 1545 | ||
1551 | spin_lock_irq(&tsk->sighand->siglock); | 1546 | spin_lock_irq(&tsk->sighand->siglock); |
1552 | if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT)) { | 1547 | if (!signal_group_exit(tsk->signal)) { |
1553 | tsk->signal->group_exit_code = exit_code; | 1548 | tsk->signal->group_exit_code = exit_code; |
1554 | zap_process(tsk); | 1549 | zap_process(tsk); |
1555 | err = 0; | 1550 | err = 0; |