Re: [PATCH] signal: Use list_del_init_careful() in flush_sigqueue()

[Oleg Nesterov <oleg@redhat.com>]

On 08/24, Thomas Gleixner wrote:
>
> --- a/fs/exec.c
> +++ b/fs/exec.c
> @@ -983,6 +983,18 @@ static int de_thread(struct task_struct
>  		}
>
>  		/*
> +		 * Ensure that POSIX timer SIGEV_THREAD_ID signals pending for
> +		 * the former leader are removed under sighand::siglock _before_
> +		 * taking over the leader's TID. Otherwise the lockless cleanup
> +		 * in release_task() can race against a concurrent signal
> +		 * delivery to the new leader. The former leader has PF_EXITING
> +		 * set which prevents queueing of SIGEV_THREAD_ID signals up to
> +		 * the point where it's sighand gets cleared.
> +		 */
> +		scoped_guard(spinlock_irq, lock)
> +			flush_sigqueue(&leader->pending);

Hmm, at first glance... If we change de_thread() to do this _after_ transfer_pid's
(before release_task(leader)), then posixtimer_send_sigqueue() doesn't need any
changes, no?

Oleg.