1 files changed, 23 insertions, 26 deletions

diff --git a/kernel/signal.c b/kernel/signal.c
index b27c01a66448..792952381092 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -378,8 +378,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
         /* We only dequeue private signals from ourselves, we don't let
          * signalfd steal them
          */
-        if (tsk == current)
-                signr = __dequeue_signal(&tsk->pending, mask, info);
+        signr = __dequeue_signal(&tsk->pending, mask, info);
         if (!signr) {
                 signr = __dequeue_signal(&tsk->signal->shared_pending,
                                          mask, info);
@@ -407,8 +406,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
                         }
                 }
         }
-        if (likely(tsk == current))
-                recalc_sigpending();
+        recalc_sigpending();
         if (signr && unlikely(sig_kernel_stop(signr))) {
                 /*
                  * Set a marker that we have dequeued a stop signal.  Our
@@ -425,7 +423,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
                 if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT))
                         tsk->signal->flags |= SIGNAL_STOP_DEQUEUED;
         }
-        if ( signr &&
+        if (signr &&
              ((info->si_code & __SI_MASK) == __SI_TIMER) &&
              info->si_sys_private){
                 /*
@@ -533,18 +531,18 @@ static int check_kill_permission(int sig, struct siginfo *info,
         if (!valid_signal(sig))
                 return error;
 
-        error = audit_signal_info(sig, t); /* Let audit system see the signal */
-        if (error)
-                return error;
-
-        error = -EPERM;
-        if ((info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info)))
-            && ((sig != SIGCONT) ||
-                (process_session(current) != process_session(t)))
-            && (current->euid ^ t->suid) && (current->euid ^ t->uid)
-            && (current->uid ^ t->suid) && (current->uid ^ t->uid)
-            && !capable(CAP_KILL))
+        if (info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info))) {
+                error = audit_signal_info(sig, t); /* Let audit system see the signal */
+                if (error)
+                        return error;
+                error = -EPERM;
+                if (((sig != SIGCONT) ||
+                        (process_session(current) != process_session(t)))
+                    && (current->euid ^ t->suid) && (current->euid ^ t->uid)
+                    && (current->uid ^ t->suid) && (current->uid ^ t->uid)
+                    && !capable(CAP_KILL))
                 return error;
+        }
 
         return security_task_kill(t, info, sig, 0);
 }
@@ -1300,20 +1298,19 @@ struct sigqueue *sigqueue_alloc(void)
 void sigqueue_free(struct sigqueue *q)
 {
         unsigned long flags;
+        spinlock_t *lock = &current->sighand->siglock;
+
         BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
         /*
          * If the signal is still pending remove it from the
-         * pending queue.
+         * pending queue. We must hold ->siglock while testing
+         * q->list to serialize with collect_signal().
          */
-        if (unlikely(!list_empty(&q->list))) {
-                spinlock_t *lock = &current->sighand->siglock;
-                read_lock(&tasklist_lock);
-                spin_lock_irqsave(lock, flags);
-                if (!list_empty(&q->list))
-                        list_del_init(&q->list);
-                spin_unlock_irqrestore(lock, flags);
-                read_unlock(&tasklist_lock);
-        }
+        spin_lock_irqsave(lock, flags);
+        if (!list_empty(&q->list))
+                list_del_init(&q->list);
+        spin_unlock_irqrestore(lock, flags);
+
         q->flags &= ~SIGQUEUE_PREALLOC;
         __sigqueue_free(q);
 }