From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754263Ab2JHRLa (ORCPT ); Mon, 8 Oct 2012 13:11:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:34213 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754081Ab2JHRL2 (ORCPT ); Mon, 8 Oct 2012 13:11:28 -0400 Date: Mon, 8 Oct 2012 19:13:01 +0200 From: Oleg Nesterov To: Andrew Morton , Linus Torvalds Cc: Al Viro , Roland McGrath , linux-kernel@vger.kernel.org Subject: Re: [PATCH 1/1] exec: make de_thread() killable Message-ID: <20121008171301.GC3259@redhat.com> References: <20120920153522.GA15426@redhat.com> <20121008170812.GA3259@redhat.com> <20121008170844.GB3259@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20121008170844.GB3259@redhat.com> User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/08, Oleg Nesterov wrote: > > and execing thread waits for execing thread. Deadlock. ^^^^^^^ Sorry, typo in the changelog.... ------------------------------------------------------------------------------ [PATCH 1/1] exec: make de_thread() killable Change de_thread() to use KILLABLE rather than UNINTERRUPTIBLE while waiting for other threads. The only complication is that we should clear ->group_exit_task and ->notify_count before we return, and we should do this under tasklist_lock. -EAGAIN is used to match the initial signal_group_exit() check/return, it doesn't really matter. This fixes the (unlikely) race with coredump. de_thread() checks signal_group_exit() before it starts to kill the subthreads, but this can't help if another CLONE_VM (but non CLONE_THREAD) task starts the coredumping after de_thread() unlocks ->siglock. In this case the killed sub-thread can block in exit_mm() waiting for coredump_finish(), execing thread waits for that sub-thead, and the coredumping thread waits for execing thread. Deadlock. Signed-off-by: Oleg Nesterov --- fs/exec.c | 16 ++++++++++++++-- 1 files changed, 14 insertions(+), 2 deletions(-) --- a/fs/exec.c +++ b/fs/exec.c @@ -878,9 +878,11 @@ static int de_thread(struct task_struct sig->notify_count--; while (sig->notify_count) { - __set_current_state(TASK_UNINTERRUPTIBLE); + __set_current_state(TASK_KILLABLE); spin_unlock_irq(lock); schedule(); + if (unlikely(__fatal_signal_pending(tsk))) + goto killed; spin_lock_irq(lock); } spin_unlock_irq(lock); @@ -898,9 +900,11 @@ static int de_thread(struct task_struct write_lock_irq(&tasklist_lock); if (likely(leader->exit_state)) break; - __set_current_state(TASK_UNINTERRUPTIBLE); + __set_current_state(TASK_KILLABLE); write_unlock_irq(&tasklist_lock); schedule(); + if (unlikely(__fatal_signal_pending(tsk))) + goto killed; } /* @@ -994,6 +998,14 @@ no_thread_group: BUG_ON(!thread_group_leader(tsk)); return 0; + +killed: + /* protects against exit_notify() and __exit_signal() */ + read_lock(&tasklist_lock); + sig->group_exit_task = NULL; + sig->notify_count = 0; + read_unlock(&tasklist_lock); + return -EAGAIN; } char *get_task_comm(char *buf, struct task_struct *tsk)