Change de_thread() to use KILLABLE rather than UNINTERRUPTIBLE while waiting for other threads. The only complication is that we should clear ->group_exit_task and ->notify_count before we return, and we should do this under tasklist_lock. -EAGAIN is used to match the initial signal_group_exit() check/return, it doesn't really matter. This fixes the (unlikely) race with coredump. de_thread() checks signal_group_exit() before it starts to kill the subthreads, but this can't help if another CLONE_VM (but non CLONE_THREAD) task starts the coredumping after de_thread() unlocks ->siglock. In this case the killed sub-thread can block in exit_mm() waiting for coredump_finish(), execing thread waits for that sub-thead, and the coredumping thread waits for execing thread. Deadlock.
Unified · Split
| @@ -878,9 +878,11 @@ static int de_thread(struct task_struct *tsk) · 877 unmodified lines | ||
| 878 | 878 | sig->notify_count--; |
| 879 | 879 | |
| 880 | 880 | while (sig->notify_count) { |
| 881 | − __set_current_state(TASK_UNINTERRUPTIBLE); | |
| 881 | + __set_current_state(TASK_KILLABLE); | |
| 882 | 882 | spin_unlock_irq(lock); |
| 883 | 883 | schedule(); |
| 884 | + if (unlikely(__fatal_signal_pending(tsk))) | |
| 885 | + goto killed; | |
| 884 | 886 | spin_lock_irq(lock); |
| 885 | 887 | } |
| 886 | 888 | spin_unlock_irq(lock); |
| @@ -898,9 +900,11 @@ static int de_thread(struct task_struct *tsk) · 11 unmodified lines | ||
| 898 | 900 | write_lock_irq(&tasklist_lock); |
| 899 | 901 | if (likely(leader->exit_state)) |
| 900 | 902 | break; |
| 901 | − __set_current_state(TASK_UNINTERRUPTIBLE); | |
| 903 | + __set_current_state(TASK_KILLABLE); | |
| 902 | 904 | write_unlock_irq(&tasklist_lock); |
| 903 | 905 | schedule(); |
| 906 | + if (unlikely(__fatal_signal_pending(tsk))) | |
| 907 | + goto killed; | |
| 904 | 908 | } |
| 905 | 909 | |
| 906 | 910 | /* |
| @@ -994,6 +998,14 @@ no_thread_group: · 87 unmodified lines | ||
| 994 | 998 | |
| 995 | 999 | BUG_ON(!thread_group_leader(tsk)); |
| 996 | 1000 | return 0; |
| 1001 | + | |
| 1002 | +killed: | |
| 1003 | + /* protects against exit_notify() and __exit_signal() */ | |
| 1004 | + read_lock(&tasklist_lock); | |
| 1005 | + sig->group_exit_task = NULL; | |
| 1006 | + sig->notify_count = 0; | |
| 1007 | + read_unlock(&tasklist_lock); | |
| 1008 | + return -EAGAIN; | |
| 997 | 1009 | } |
| 998 | 1010 | |
| 999 | 1011 | char *get_task_comm(char *buf, struct task_struct *tsk) |