[PATCH v2] pid_namespace: make zap_pid_ns_processes() freezable

[PATCH v2] pid_namespace: make zap_pid_ns_processes() freezable

[Aviv Vaknin]

When the init of a pid namespace exits, zap_pid_ns_processes() waits
until all other pids in the namespace are freed. A tracer outside the
namespace that does not reap its traced zombies keeps those pids
allocated, so this wait has no upper bound, and while it lasts every
suspend attempt fails:

  Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):

Neither wait is freezable. The first loop sleeps in do_wait(), which
returns -ERESTARTSYS on the freezer's fake signal; the loop then clears
TIF_SIGPENDING and waits again without ever freezing. The final loop
sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING
there, schedule() returns immediately after the first freeze attempt
and the task spins until the wait ends.

Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the
freezer can freeze tasks waiting there directly, and in TASK_IDLE |
TASK_FREEZABLE in the final loop, like coredump_task_exit() does.

This was hit with Chromium-based browsers: crashpad ptrace-attaches the
threads of a crashed renderer, which is a pid namespace init, and does
not reap those killed during the dump.

Fixes: 3eb07c8c8adb ("pid namespaces: destroy pid namespace on init's death")
Fixes: b9a985db9896 ("pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes")
Cc: stable@vger.kernel.org # 6.1+
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Aviv Vaknin <vaknins33@gmail.com>
---
v2:
- Make do_wait() freezable instead of calling try_to_freeze() after
  kernel_wait4() (Oleg).
- Drop the comments.
- Drop the acks and the review tag, since the approach changed.
- Retested on v7.3-rc5 with the reproducer from v1, also unprivileged:
  freezing completes in 0.001 s, the zap task stays idle, and reaping
  the zombies still ends the wait.

v1: https://lore.kernel.org/r/20261001121254.883973-1-vaknins33@gmail.com

 kernel/exit.c          | 2 +-
 kernel/pid_namespace.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/exit.c b/kernel/exit.c
index 97686af89..b54cc7b2b 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1751,7 +1751,7 @@ static long do_wait(struct wait_opts *wo)
 	add_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
 
 	do {
-		set_current_state(TASK_INTERRUPTIBLE);
+		set_current_state(TASK_INTERRUPTIBLE | TASK_FREEZABLE);
 		retval = __do_wait(wo);
 		if (retval != -ERESTARTSYS)
 			break;
diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 8bc9edb40..127a5fd23 100644
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -269,7 +269,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
 	 * free_pid() will awaken this task.
 	 */
 	for (;;) {
-		set_current_state(TASK_INTERRUPTIBLE);
+		set_current_state(TASK_IDLE | TASK_FREEZABLE);
 		if (pid_ns->pid_allocated == init_pids)
 			break;
 		schedule();

base-commit: ed14a591175bb5f56c2936b082cffb9e4b935e6d
-- 
2.55.0

Re: [PATCH v2] pid_namespace: make zap_pid_ns_processes() freezable

[Bradley Morgan]

On 2 October 2026 21:28:20 BST, Aviv Vaknin <vaknins33@gmail.com> wrote:
>When the init of a pid namespace exits, zap_pid_ns_processes() waits
>until all other pids in the namespace are freed. A tracer outside the
>namespace that does not reap its traced zombies keeps those pids
>allocated, so this wait has no upper bound, and while it lasts every
>suspend attempt fails:
>
>  Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):
>
>Neither wait is freezable. The first loop sleeps in do_wait(), which
>returns -ERESTARTSYS on the freezer's fake signal; the loop then clears
>TIF_SIGPENDING and waits again without ever freezing. The final loop
>sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING
>there, schedule() returns immediately after the first freeze attempt
>and the task spins until the wait ends.
>
>Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the
>freezer can freeze tasks waiting there directly, and in TASK_IDLE |
>TASK_FREEZABLE in the final loop, like coredump_task_exit() does.
>
>This was hit with Chromium-based browsers: crashpad ptrace-attaches the
>threads of a crashed renderer, which is a pid namespace init, and does
>not reap those killed during the dump.

Suggestion: We could do a ASCII table of the bug to make it "look" cool, I mean, you certainly don't have to.

My tag stands:

Reviewed-by: Bradley Morgan <brads@mainlining.org>

>
>Fixes: 3eb07c8c8adb ("pid namespaces: destroy pid namespace on init's death")
>Fixes: b9a985db9896 ("pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes")
>Cc: stable@vger.kernel.org # 6.1+
>Suggested-by: Oleg Nesterov <oleg@redhat.com>
>Assisted-by: Claude:claude-opus-5-5
>Signed-off-by: Aviv Vaknin <vaknins33@gmail.com>
>---
>v2:
>- Make do_wait() freezable instead of calling try_to_freeze() after
>  kernel_wait4() (Oleg).
>- Drop the comments.
>- Drop the acks and the review tag, since the approach changed.
>- Retested on v7.3-rc5 with the reproducer from v1, also unprivileged:
>  freezing completes in 0.001 s, the zap task stays idle, and reaping
>  the zombies still ends the wait.
>
>v1: https://lore.kernel.org/r/20261001121254.883973-1-vaknins33@gmail.com
>
> kernel/exit.c          | 2 +-
> kernel/pid_namespace.c | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/kernel/exit.c b/kernel/exit.c
>index 97686af89..b54cc7b2b 100644
>--- a/kernel/exit.c
>+++ b/kernel/exit.c
>@@ -1751,7 +1751,7 @@ static long do_wait(struct wait_opts *wo)
> 	add_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
> 
> 	do {
>-		set_current_state(TASK_INTERRUPTIBLE);
>+		set_current_state(TASK_INTERRUPTIBLE | TASK_FREEZABLE);
> 		retval = __do_wait(wo);
> 		if (retval != -ERESTARTSYS)
> 			break;
>diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
>index 8bc9edb40..127a5fd23 100644
>--- a/kernel/pid_namespace.c
>+++ b/kernel/pid_namespace.c
>@@ -269,7 +269,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
> 	 * free_pid() will awaken this task.
> 	 */
> 	for (;;) {
>-		set_current_state(TASK_INTERRUPTIBLE);
>+		set_current_state(TASK_IDLE | TASK_FREEZABLE);
> 		if (pid_ns->pid_allocated == init_pids)
> 			break;
> 		schedule();
>
>base-commit: ed14a591175bb5f56c2936b082cffb9e4b935e6d
>


--- Thanks!
https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@grrlz.net/

Re: [PATCH v2] pid_namespace: make zap_pid_ns_processes() freezable

[Oleg Nesterov]

On 10/02, Aviv Vaknin wrote:
>
> --- a/kernel/exit.c
> +++ b/kernel/exit.c
> @@ -1751,7 +1751,7 @@ static long do_wait(struct wait_opts *wo)
>  	add_wait_queue(&current->signal->wait_chldexit, &wo->child_wait);
>  
>  	do {
> -		set_current_state(TASK_INTERRUPTIBLE);
> +		set_current_state(TASK_INTERRUPTIBLE | TASK_FREEZABLE);
>  		retval = __do_wait(wo);
>  		if (retval != -ERESTARTSYS)
>  			break;
> diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
> index 8bc9edb40..127a5fd23 100644
> --- a/kernel/pid_namespace.c
> +++ b/kernel/pid_namespace.c
> @@ -269,7 +269,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
>  	 * free_pid() will awaken this task.
>  	 */
>  	for (;;) {
> -		set_current_state(TASK_INTERRUPTIBLE);
> +		set_current_state(TASK_IDLE | TASK_FREEZABLE);
>  		if (pid_ns->pid_allocated == init_pids)
>  			break;
>  		schedule();

Thanks Aviv,

Acked-by: Oleg Nesterov <oleg@redhat.com>

Re: [PATCH v2] pid_namespace: make zap_pid_ns_processes() freezable

[Christian Brauner]

On Fri, 02 Oct 2026 23:28:20 +0300, Aviv Vaknin wrote:
> When the init of a pid namespace exits, zap_pid_ns_processes() waits
> until all other pids in the namespace are freed. A tracer outside the
> namespace that does not reap its traced zombies keeps those pids
> allocated, so this wait has no upper bound, and while it lasts every
> suspend attempt fails:
> 
>   Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):
> 
> [...]

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] pid_namespace: make zap_pid_ns_processes() freezable
      https://git.kernel.org/vfs/vfs/c/23194f382636