Re: [PATCH] signal: Use list_del_init_careful() in flush_sigqueue()

[Thomas Gleixner <tglx@kernel.org>]

On Mon, Aug 24 2026 at 13:02, Oleg Nesterov wrote:
> On 08/24, Thomas Gleixner wrote:
>>
>> --- a/fs/exec.c
>> +++ b/fs/exec.c
>> @@ -983,6 +983,18 @@ static int de_thread(struct task_struct
>>  		}
>>
>>  		/*
>> +		 * Ensure that POSIX timer SIGEV_THREAD_ID signals pending for
>> +		 * the former leader are removed under sighand::siglock _before_
>> +		 * taking over the leader's TID. Otherwise the lockless cleanup
>> +		 * in release_task() can race against a concurrent signal
>> +		 * delivery to the new leader. The former leader has PF_EXITING
>> +		 * set which prevents queueing of SIGEV_THREAD_ID signals up to
>> +		 * the point where it's sighand gets cleared.
>> +		 */
>> +		scoped_guard(spinlock_irq, lock)
>> +			flush_sigqueue(&leader->pending);
>
> Hmm, at first glance... If we change de_thread() to do this _after_ transfer_pid's
> (before release_task(leader)), then posixtimer_send_sigqueue() doesn't need any
> changes, no?

That should work nicely.