__group_complete_signal: fix coredump with group stop race
PATCH 1/1 __group_complete_signal: fix coredump with group stop race
When __group_complete_signal() sees sig_kernel_coredump() signal, it starts the group stop, but sets ->group_exit_task = t in a hope that "t" will actually dequeue this signal and invoke do_coredump(). However, by the time "t" enters get_signal_to_deliver() it is possible that the signal was blocked/ignored or we have another pending !SIG_KERNEL_COREDUMP_MASK signal which will be dequeued first. This means the task could be stopped but not killed.
Remove this code from __group_complete_signal(). Note also this patch removes the bogus signal_wake_up(t, 1). This thread can't be STOPPED/TRACED, note the corresponding check in wants_signal().
Signed-off-by Oleg Nesterov <[email protected]>
kernel/signal.c renamed from kernel/signal.c~1_CDUMP_STOP +0 -30
@@ -911,27 +911,6 @@ __group_complete_signal(int sig, struct }while_each_thread (p, t);return ; } - -/* -* There will be a core dump. We make all threads other -* than the chosen one go into a group stop so that nothing -* happens until it gets scheduled, takes the signal off -* the shared queue, and does the core dump. This is a -* little more complicated than strictly necessary, but it -* keeps the signal state that winds up in the core dump -* unchanged from the death state, e.g. which thread had -* the core-dump signal unblocked. -*/ -rm_from_queue (SIG_KERNEL_STOP_MASK , &t->pending); -rm_from_queue (SIG_KERNEL_STOP_MASK , &p->signal->shared_pending); - p->signal->group_stop_count =0 ; - p->signal->group_exit_task = t; - p = t; - do { - p->signal->group_stop_count++; - signal_wake_up(t, t == p); - } while_each_thread(p, t); - return; }/*
@@ -1757,15 +1736,6 @@ static int handle_group_stop(void) {int stop_count; -if (current->signal->group_exit_task == current) { -/* -* Group stop is so we can do a core dump, -* We are the initiating thread, so get on with it. -*/ - current->signal->group_exit_task =NULL ; -return 0 ; - } -if (current->signal->flags &SIGNAL_GROUP_EXIT )/* * Group stop is so another thread can do a core dump,