Messages in this thread | | | Date | Tue, 22 Jun 2021 08:34:06 +0200 | From | Oleg Nesterov <> | Subject | Re: [PATCH] signal: Prevent sigqueue caching after task got released |
| |
On 06/22, Thomas Gleixner wrote: > > syzbot reported a memory leak related to sigqueue caching. This happens > when a thread group leader with child tasks is reaped. > > The group leader's sigqueue_cache is correctly freed. The group leader then > reaps the child tasks and if any of them has a signal pending it caches > that signal.
I guess you mean the race with exit_notify() ? Could you spell please? I am just curious how exactly this problem was found.
This doesn't really matter, because damn yes, a task T can call release_task(another_task)->sigqueue_cache_or_free() after exit_task_sigqueue_cache(T) was already called. For example, a last non-leader thread exits and reaps a zombie leader.
Somehow I thought that exit_task_sigqueue_cache() at the end of __exit_signal() should fix this problem, but this is obviously wrong.
> @@ -463,13 +469,18 @@ void exit_task_sigqueue_cache(struct tas > struct sigqueue *q = tsk->sigqueue_cache; > > if (q) { > - tsk->sigqueue_cache = NULL; > /* > * Hand it back to the cache as the task might > * be self reaping which would leak the object. > */ > kmem_cache_free(sigqueue_cachep, q); > } > + > + /* > + * Set an error pointer to ensure that @tsk will not cache a > + * sigqueue when it is reaping it's child tasks > + */ > + tsk->sigqueue_cache = ERR_PTR(-1); > }
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
| |