lkml.org 
[lkml]   [2021]   [Jun]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] signal: Prevent sigqueue caching after task got released
On 06/22, Thomas Gleixner wrote:
>
> syzbot reported a memory leak related to sigqueue caching. This happens
> when a thread group leader with child tasks is reaped.
>
> The group leader's sigqueue_cache is correctly freed. The group leader then
> reaps the child tasks and if any of them has a signal pending it caches
> that signal.

I guess you mean the race with exit_notify() ? Could you spell please?
I am just curious how exactly this problem was found.

This doesn't really matter, because damn yes, a task T can call
release_task(another_task)->sigqueue_cache_or_free() after
exit_task_sigqueue_cache(T) was already called. For example, a last non-leader
thread exits and reaps a zombie leader.

Somehow I thought that exit_task_sigqueue_cache() at the end of __exit_signal()
should fix this problem, but this is obviously wrong.


> @@ -463,13 +469,18 @@ void exit_task_sigqueue_cache(struct tas
> struct sigqueue *q = tsk->sigqueue_cache;
>
> if (q) {
> - tsk->sigqueue_cache = NULL;
> /*
> * Hand it back to the cache as the task might
> * be self reaping which would leak the object.
> */
> kmem_cache_free(sigqueue_cachep, q);
> }
> +
> + /*
> + * Set an error pointer to ensure that @tsk will not cache a
> + * sigqueue when it is reaping it's child tasks
> + */
> + tsk->sigqueue_cache = ERR_PTR(-1);
> }


Reviewed-by: Oleg Nesterov <oleg@redhat.com>

\
 
 \ /
  Last update: 2021-06-22 08:34    [W:0.051 / U:0.504 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site