Re: [PATCH] fix race copy_process() vs de_thread()

From: Hiroshi Shimamoto
Date: Mon Aug 24 2009 - 02:33:47 EST

Roland McGrath wrote:
> I'm not sure I follow the problem scenario you are citing.
> The thread in copy_process() will return -ERESTARTNOINTR
> after calling cleanup_signal(), which does properly decrement
> sig->count to return it to the state before the copy_process() call.
> Then this thread will get to signal handling, dequeue its SIGKILL from
> zap_other_threads(), and die itself. When it's finally reaped, by itself
> in exit_notify(), or by de_thread() in the case of a replaced group_leader,
> the normal __exit_signal() will do that group_exit_task logic.
> What part of this sequence fails to occur in your tests?

The point is that de_thread() waits until other thread calls wake_up_process().
In __exit_signal() when sig->count == 2, the thread calls wake_up_process(),
and then de_thread() will continue. However if another thread is during
copy_process(), the sig->count is incremented at copy_signal(). That makes
no wake_up_process().

The scenario flow is like this;

thread A thread B thread C sig->count
| | | 3
clone() exec() | |
copy_process() de_thread() | |
copy_signal() | | 4
| zap | 4
| | __exit_signal() 3 no wake up
clean_signal() | 2 no wake up
| | during copy_process()
exit |
never wake up

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at