uglify kill_pid_info() to fix kill() vs exec() race
PATCH 1/2 uglify kill_pid_info() to fix kill() vs exec() race
kill_pid_info()->pid_task() could be the old leader of the execing process. In that case it is possible that the leader will be released before we take siglock. This means that kill_pid_info() (and thus sys_kill()) can return a false -ESRCH.
Change the code to retry when lock_task_sighand() fails. The endless loop is not possible, __exit_signal() both clears ->sighand and does detach_pid().
Signed-off-by Oleg Nesterov <[email protected]>
kernel/signal.c renamed from kernel/signal.c~1_kill_exec_race +12 -3
@@ -1049,17 +1049,26 @@ int kill_pgrp_info(int sig, struct siginint kill_pid_info (int sig,struct siginfo *info,struct pid *pid) { -int error; +int error = -ESRCH ;struct task_struct *p;rcu_read_lock ();if (unlikely (sig_needs_tasklist (sig)))read_lock (&tasklist_lock); +retry: p =pid_task (pid,PIDTYPE_PID ); - error = -ESRCH ; -if (p) +if (p) { error =group_send_sig_info (sig, info, p); +if (unlikely (error == -ESRCH )) +/* +* The task was unhashed in between, try again. +* If it is dead, pid_task() will return NULL, +* if we race with de_thread() it will find the +* new leader. +*/ + goto retry; + }if (unlikely (sig_needs_tasklist (sig)))read_unlock (&tasklist_lock);