Messages in this thread | | | Date | Mon, 06 Feb 2006 20:10:38 +0300 | From | Oleg Nesterov <> | Subject | Re: [PATCH] fix kill_proc_info() vs copy_process() race |
| |
Oleg Nesterov wrote: > > This means that we can find a task in kill_proc_info()->find_task_by_pid() > which is not registered as part of thread group yet. Various bad things can > happen, note that handle_stop_signal(SIGCONT) and __group_complete_signal() > iterate over threads list. But p->pids[PIDTYPE_TGID] is a copy of current's > 'struct pid' from dup_task_struct(), and if we don't have CLONE_THREAD here > we will use completely unreleated (parent's) thread list. > > I think we can solve these problems by enlarging a ->siglock's scope in > copy_process(), but I don't know how to test this patch. > > NOTE: release_task()->__unhash_process() path is safe, we already have > ->sighand == NULL while detaching PIDTYPE_PID/PIDTYPE_TGID nonatomically.
Sorry, I was wrong. Without CLONE_THREAD current->sighand.siglock can't help, we need p->sighand.siglock, I beleive.
Am I correct that the bug exists at least?
Oleg. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |