We have a lot of problems with accessing task_struct->signal, it can "disappear" at any moment. Even current can't use its ->signal safely after exit_notify(). ->siglock helps, but it is not convenient, not always possible, and sometimes it makes sense to use task->signal even after this task has already dead. This patch adds the reference counter, sigcnt, into signal_struct. This reference is owned by task_struct and it is dropped in __put_task_struct(). Perhaps it makes sense to export get/put_signal_struct() later, but currently I don't see the immediate reason. Rename __cleanup_signal() to free_signal_struct() and unexport it. With the previous changes it does nothing except kmem_cache_free(). Change __exit_signal() to not clear/free ->signal, it will be freed when the last reference to any thread in the thread group goes away. Note: - when the last thead exits signal->tty can point to nowhere, see the next patch. - with or without this patch signal_struct->count should go away, or at least it should be "int nr_threads" for fs/proc. This will be addressed later.
Showing the changes to kernel (2 of 3 files). Show all
Unified · Split
| @@ -134,8 +134,6 @@ static void __exit_signal(struct task_struct *tsk) · 133 unmodified lines | |||
| 134 | * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals. | 134 | * doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals. |
| 135 | */ | 135 | */ |
| 136 | flush_sigqueue(&tsk->pending); | 136 | flush_sigqueue(&tsk->pending); |
| 137 | |||
| 138 | tsk->signal = NULL; | ||
| 139 | tsk->sighand = NULL; | 137 | tsk->sighand = NULL; |
| 140 | spin_unlock(&sighand->siglock); | 138 | spin_unlock(&sighand->siglock); |
| 141 | 139 | ||
| @@ -150,7 +148,6 @@ static void __exit_signal(struct task_struct *tsk) · 8 unmodified lines | |||
| 150 | */ | 148 | */ |
| 151 | task_rq_unlock_wait(tsk); | 149 | task_rq_unlock_wait(tsk); |
| 152 | tty_kref_put(sig->tty); | 150 | tty_kref_put(sig->tty); |
| 153 | __cleanup_signal(sig); | ||
| 154 | } | 151 | } |
| 155 | } | 152 | } |
| 156 | 153 | ||
| @@ -165,6 +165,18 @@ void free_task(struct task_struct *tsk) · 164 unmodified lines | |||
| 165 | } | 165 | } |
| 166 | EXPORT_SYMBOL(free_task); | 166 | EXPORT_SYMBOL(free_task); |
| 167 | 167 | ||
| 168 | static inline void free_signal_struct(struct signal_struct *sig) | ||
| 169 | { | ||
| 170 | thread_group_cputime_free(sig); | ||
| 171 | kmem_cache_free(signal_cachep, sig); | ||
| 172 | } | ||
| 173 | |||
| 174 | static inline void put_signal_struct(struct signal_struct *sig) | ||
| 175 | { | ||
| 176 | if (atomic_dec_and_test(&sig->sigcnt)) | ||
| 177 | free_signal_struct(sig); | ||
| 178 | } | ||
| 179 | |||
| 168 | void __put_task_struct(struct task_struct *tsk) | 180 | void __put_task_struct(struct task_struct *tsk) |
| 169 | { | 181 | { |
| 170 | WARN_ON(!tsk->exit_state); | 182 | WARN_ON(!tsk->exit_state); |
| @@ -173,6 +185,7 @@ void __put_task_struct(struct task_struct *tsk) · 2 unmodified lines | |||
| 173 | 185 | ||
| 174 | exit_creds(tsk); | 186 | exit_creds(tsk); |
| 175 | delayacct_tsk_free(tsk); | 187 | delayacct_tsk_free(tsk); |
| 188 | put_signal_struct(tsk->signal); | ||
| 176 | 189 | ||
| 177 | if (!profile_handoff_task(tsk)) | 190 | if (!profile_handoff_task(tsk)) |
| 178 | free_task(tsk); | 191 | free_task(tsk); |
| @@ -864,6 +877,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk) · 685 unmodified lines | |||
| 864 | if (!sig) | 877 | if (!sig) |
| 865 | return -ENOMEM; | 878 | return -ENOMEM; |
| 866 | 879 | ||
| 880 | atomic_set(&sig->sigcnt, 1); | ||
| 867 | atomic_set(&sig->count, 1); | 881 | atomic_set(&sig->count, 1); |
| 868 | atomic_set(&sig->live, 1); | 882 | atomic_set(&sig->live, 1); |
| 869 | init_waitqueue_head(&sig->wait_chldexit); | 883 | init_waitqueue_head(&sig->wait_chldexit); |
| @@ -889,12 +903,6 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk) · 19 unmodified lines | |||
| 889 | return 0; | 903 | return 0; |
| 890 | } | 904 | } |
| 891 | 905 | ||
| 892 | void __cleanup_signal(struct signal_struct *sig) | ||
| 893 | { | ||
| 894 | thread_group_cputime_free(sig); | ||
| 895 | kmem_cache_free(signal_cachep, sig); | ||
| 896 | } | ||
| 897 | |||
| 898 | static void copy_flags(unsigned long clone_flags, struct task_struct *p) | 906 | static void copy_flags(unsigned long clone_flags, struct task_struct *p) |
| 899 | { | 907 | { |
| 900 | unsigned long new_flags = p->flags; | 908 | unsigned long new_flags = p->flags; |
| @@ -1248,6 +1256,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, · 347 unmodified lines | |||
| 1248 | } | 1256 | } |
| 1249 | 1257 | ||
| 1250 | if (clone_flags & CLONE_THREAD) { | 1258 | if (clone_flags & CLONE_THREAD) { |
| 1259 | atomic_inc(¤t->signal->sigcnt); | ||
| 1251 | atomic_inc(¤t->signal->count); | 1260 | atomic_inc(¤t->signal->count); |
| 1252 | atomic_inc(¤t->signal->live); | 1261 | atomic_inc(¤t->signal->live); |
| 1253 | p->group_leader = current->group_leader; | 1262 | p->group_leader = current->group_leader; |
| @@ -1294,7 +1303,7 @@ bad_fork_cleanup_mm: · 40 unmodified lines | |||
| 1294 | mmput(p->mm); | 1303 | mmput(p->mm); |
| 1295 | bad_fork_cleanup_signal: | 1304 | bad_fork_cleanup_signal: |
| 1296 | if (!(clone_flags & CLONE_THREAD)) | 1305 | if (!(clone_flags & CLONE_THREAD)) |
| 1297 | __cleanup_signal(p->signal); | 1306 | free_signal_struct(p->signal); |
| 1298 | bad_fork_cleanup_sighand: | 1307 | bad_fork_cleanup_sighand: |
| 1299 | __cleanup_sighand(p->sighand); | 1308 | __cleanup_sighand(p->sighand); |
| 1300 | bad_fork_cleanup_fs: | 1309 | bad_fork_cleanup_fs: |