Re: [PATCH] signal: Use list_del_init_careful() in flush_sigqueue()

[Oleg Nesterov <oleg@redhat.com>]

On 08/24, Hyunwoo Kim wrote:
>
> On Sun, Aug 23, 2026 at 02:47:10PM +0200, Oleg Nesterov wrote:
> >
> > Can't we avoid list_del_init() altogether? Can't flush_sigqueue() simply do
> >
> > 	list_for_each_entry(q, &pending->list, list)
> > 		__sigqueue_free(q);
> >
> > ?
>
> __sigqueue_free() does kmem_cache_free() for anything which is not
> PREALLOC, so the iterator reads q->list.next after it is freed.

Yes, sorry, I meant _safe() of course...

> And flush_signals() and selinux_bprm_committed_creds() call it on live
> tasks, so the queue has to end up empty.

Right, thanks, I forgot that flush_sigqueue() has other callers.

> So,
>
> 	list_for_each_entry_safe(q, n, &queue->list, list)
> 		__sigqueue_free(q);
> 	INIT_LIST_HEAD(&queue->list);
>
> If you are fine with it, could you submit this patch yourself? I am also
> attaching the reproducer and the mdelay diff. I hope they help.

Let me think about it a bit more... And thanks a lot again.

Oleg.