[PATCH] copy_process: cleanup bad_fork_cleanup_signal

__exit_signal() does important cleanups atomically under ->siglock.  It is
also called from copy_process's error path.  This is not good, for example we
can't move __unhash_process() under ->siglock for that reason.

We should not mix these 2 paths, just look at ugly 'if (p->sighand)' under
'bad_fork_cleanup_sighand:' label.  For copy_process() case it is sufficient
to just backout copy_signal(), nothing more.

Again, nobody can see this task yet.  For CLONE_THREAD case we just decrement
signal->count, otherwise nobody can see this ->signal and we can free it
lockless.

This patch assumes it is safe to do exit_thread_group_keys() without
tasklist_lock.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 1 insertions, 14 deletions

diff --git a/kernel/signal.c b/kernel/signal.c
index 1d7f4463c32d..54e9ef673e68 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -395,23 +395,10 @@ void __exit_signal(struct task_struct *tsk)
         clear_tsk_thread_flag(tsk,TIF_SIGPENDING);
         flush_sigqueue(&tsk->pending);
         if (sig) {
-                /*
-                 * We are cleaning up the signal_struct here.
-                 */
-                exit_thread_group_keys(sig);
-                kmem_cache_free(signal_cachep, sig);
+                __cleanup_signal(sig);
         }
 }
 
-void exit_signal(struct task_struct *tsk)
-{
-        atomic_dec(&tsk->signal->live);
-
-        write_lock_irq(&tasklist_lock);
-        __exit_signal(tsk);
-        write_unlock_irq(&tasklist_lock);
-}
-
 /*
  * Flush all handlers for a task.
  */