Re: [PATCH] fix de_thread() vs do_coredump() deadlock

[Roland McGrath <roland@redhat.com>]

> I still think we are ok with no ptrace. If that (non-coredump) signal was
> delivered before de_thread sets SIGNAL_GROUP_EXIT, then this flag is set
> by __group_complete_signal(), so de_thread return -EAGAIN. If de_thread()
> wins, the signal will be dequeued later from ->shared_pending.

There is no guarantee that __group_complete_signal gets to that code path
when the signal is generated.  There may be no thread that doesn't have it
blocked nor is already descheduled with pending signals.  Then some thread
gets scheduled, or changes it signal mask, and then gets into
get_signal_to_deliver and takes the siglock either before an exec'ing
thread gets the lock, or while the exec'ing thread releases it to wait.
When the dequeuer thread releases the siglock, we have the race window.
(There is another similar case if the signal was handled at generation time
and the handler is reset to SIG_DFL later in a race with another thread
dequeuing the signal and a third doing an exec.)


Thanks,
Roland