From: Thomas Gleixner <tglx@kernel.org>
To: Frederic Weisbecker <frederic@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>,
LKML <linux-kernel@vger.kernel.org>,
Hyunwoo Kim <imv4bel@gmail.com>,
Christian Brauner <brauner@kernel.org>,
Peter Zijlstra <peterz@infradead.org>,
John Stultz <jstultz@google.com>, Ingo Molnar <mingo@kernel.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
"Eric W. Biederman" <ebiederm@xmission.com>,
stable@vger.kernel.org
Subject: Re: [patch 1/8] signal: Prevent exec() race
Date: Sat, 05 Sep 2026 13:22:39 +0200 [thread overview]
Message-ID: <87o6ec54e8.ffs@fw13> (raw)
In-Reply-To: <apvJ0PO7DJnh1JHS@pavilion.home>
On Sat, Sep 05 2026 at 09:50, Frederic Weisbecker wrote:
> Le Sat, Sep 05, 2026 at 09:34:52AM +0200, Thomas Gleixner a écrit :
>> On Fri, Sep 04 2026 at 13:35, Oleg Nesterov wrote:
>> > Thomas, I can't read this series today, will try on Weekend.
>> >
>> > But you didn't reply to
>> > https://lore.kernel.org/all/apgHJj0qH7HlAXKO@redhat.com/
>> > Let me quote that email here:
>> >
>> > OK... lets suppose the exiting task T passes exit_signals().
>> >
>> > Suppose we have an "ignored" timer tmr. Another sub-thread calls
>> > do_sigaction() -> posixtimer_sig_unignore() and finds that tmr
>> > in ->ignored_posix_timers list.
>> >
>> > But posixtimer_queue_sigqueue() doesn't check PF_EXITING, I guess
>> > it should check it too?
>>
>> From the patch:
>>
>> @@ -1990,6 +2004,9 @@ void posixtimer_send_sigqueue(struct k_i
>> if (!likely(lock_task_sighand(t, &flags)))
>> return;
>>
>> + if (unlikely(tmr->it_pid_type == PIDTYPE_PID && (t->flags & PF_EXITING)))
>> + goto unlock;
>> +
>
> But posixtimer_sig_unignore() calls directly posixtimer_queue_sigqueue(), not
> posixtimer_send_sigqueue().
I obviously can't read.
> However posixtimer_queue_sigqueue() -> complete_signal() -> wants_signal()
> checks PF_EXITING and complete_signal() then just drops it.
>
> Ah but doesn't that leak a refcount drop? Looks like the PF_EXITING check should
> indeed move to posixtimer_get_target().
Again. get_target() is not protected by sighand lock when called in
posxtimer_send_sigqueue().
Let me stare at it some more.
next prev parent reply other threads:[~2026-09-05 11:22 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 11:22 [patch 0/8] exec/exit: POSIX timer related bugfixes and related cleanups Thomas Gleixner
2026-09-04 11:22 ` [patch 1/8] signal: Prevent exec() race Thomas Gleixner
2026-09-04 11:35 ` Oleg Nesterov
2026-09-05 7:34 ` Thomas Gleixner
2026-09-05 7:50 ` Frederic Weisbecker
2026-09-05 11:22 ` Thomas Gleixner [this message]
2026-09-04 11:22 ` [patch 2/8] exec: Cleanup POSIX timers right after de_thread() Thomas Gleixner
2026-09-04 11:22 ` [patch 3/8] posix-timers: Move posixtimer_exec_cleanup() out of exec.c Thomas Gleixner
2026-09-04 11:22 ` [patch 4/8] posix-timers: Move POSIX timer group exit related code out of do_exit() Thomas Gleixner
2026-09-04 11:22 ` [patch 5/8] posix-cpu-timers: Move inlines out of public header Thomas Gleixner
2026-09-04 11:22 ` [patch 6/8] posix-cpu-timers: Use PF_EXITING to indicate exit Thomas Gleixner
2026-09-04 11:22 ` [patch 7/8] posix-cpu-timers: Prevent enqueueing when PF_EXITING is set Thomas Gleixner
2026-09-04 12:06 ` Eric W. Biederman
2026-09-04 15:47 ` Eric W. Biederman
2026-09-05 7:50 ` Thomas Gleixner
2026-09-04 11:22 ` [patch 8/8] posix-timers: Handle exit in do_exit() completely Thomas Gleixner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87o6ec54e8.ffs@fw13 \
--to=tglx@kernel.org \
--cc=brauner@kernel.org \
--cc=ebiederm@xmission.com \
--cc=frederic@kernel.org \
--cc=imv4bel@gmail.com \
--cc=jstultz@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=oleg@redhat.com \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®