Oleg Nesterov
60187d2708
sigqueue_free: fix the race with collect_signal() ...
Spotted by taoyue <yue.tao@windriver.com> and Jeremy Katz <jeremy.katz@windriver.com>.
collect_signal: sigqueue_free:
list_del_init(&first->list);
if (!list_empty(&q->list)) {
// not taken
}
q->flags &= ~SIGQUEUE_PREALLOC;
__sigqueue_free(first); __sigqueue_free(q);
Now, __sigqueue_free() is called twice on the same "struct sigqueue" with the
obviously bad implications.
In particular, this double free breaks the array_cache->avail logic, so the
same sigqueue could be "allocated" twice, and the bug can manifest itself via
the "impossible" BUG_ON(!SIGQUEUE_PREALLOC) in sigqueue_free/send_sigqueue.
Hopefully this can explain these mysterious bug-reports, see
http://marc.info/?t=118766926500003
http://marc.info/?t=118466273000005
Alexey Dobriyan reports this patch makes the difference for the testcase, but
nobody has an access to the application which opened the problems originally.
Also, this patch removes tasklist lock/unlock, ->siglock is enough.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: taoyue <yue.tao@windriver.com>
Cc: Jeremy Katz <jeremy.katz@windriver.com>
Cc: Sukadev Bhattiprolu <sukadev@us.ibm.com>
Cc: Alexey Dobriyan <adobriyan@sw.ru>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Roland McGrath <roland@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-08-31 01:42:23 -07:00
request_irq: fix DEBUG_SHIRQ handling
2007-08-31 01:42:23 -07:00
PM: Fix dependencies of CONFIG_SUSPEND and CONFIG_HIBERNATION
2007-08-31 01:42:22 -07:00
timer: remove clockevents_unregister_notifier
2007-08-11 15:47:42 -07:00
gitignore: ignore more generated files
2006-01-03 11:35:26 +01:00
Cleanup non-arch xtime uses, use get_seconds() or current_kernel_time().
2007-07-25 10:09:20 -07:00
Freezer: make kernel threads nonfreezable by default
2007-07-17 10:23:02 -07:00
Audit: add TTY input auditing
2007-07-16 09:05:47 -07:00
[PATCH] allow audit filtering on bit & operations
2007-07-22 09:57:02 -04:00
kernel/auditsc.c: fix an off-by-one
2007-08-22 19:52:44 -07:00
[PATCH] pid: replace do/while_each_task_pid with do/while_each_pid_task
2007-02-12 09:48:32 -08:00
signal/timer/event: timerfd compat code
2007-05-11 08:29:36 -07:00
use simple_read_from_buffer in kernel/
2007-05-09 12:30:49 -07:00
PM: Fix dependencies of CONFIG_SUSPEND and CONFIG_HIBERNATION
2007-08-31 01:42:22 -07:00
usermodehelper: Tidy up waiting
2007-07-18 08:47:40 -07:00
sched: update delay-accounting to use CFS's precise stats
2007-07-09 18:52:00 +02:00
move die notifier handling to common code
2007-05-08 11:15:04 -07:00
[PATCH] struct seq_operations and struct file_operations constification
2006-12-07 08:39:46 -08:00
Remove obsolete #include <linux/config.h>
2006-06-30 19:25:36 +02:00
Assign task_struct.exit_code before taskstats_exit()
2007-08-31 01:42:22 -07:00
[PATCH] symbol_put_addr() locks kernel
2006-05-15 11:20:55 -07:00
mm: Remove slab destructors from kmem_cache_create().
2007-07-20 10:11:58 +09:00
futex_unlock_pi() hurts my brain and may cause application deadlock
2007-08-22 19:52:44 -07:00
Revert "futex_requeue_pi optimization"
2007-06-18 09:48:41 -07:00
Cache xtime every call to update_wall_time
2007-07-25 10:17:44 -07:00
The scheduled -EINVAL for invalid timevals in setitimer
2007-05-08 11:15:13 -07:00
kallsyms: make KSYM_NAME_LEN include space for trailing '\0'
2007-07-17 10:23:03 -07:00
[PATCH] HZ: 300Hz support
2006-12-07 08:39:36 -08:00
[PATCH] sched: arch preempt notifier mechanism
2007-07-26 13:40:43 +02:00
kdump/kexec: calculate note size at compile time
2007-05-08 11:15:07 -07:00
is_power_of_2: kernel/kfifo.c
2007-07-16 09:05:50 -07:00
kernel-doc fix for kmod.c
2007-07-26 11:33:06 -07:00
fix compilation with gcc 4.2
2007-08-11 15:47:42 -07:00
FRV: Fix linkage problems
2007-07-20 12:01:34 -07:00
kthread: silence bogus section mismatch warning
2007-07-31 15:39:42 -07:00
[PATCH] severing module.h->sched.h
2006-12-04 02:00:22 -05:00
lockdep debugging: give stacktrace for init_error
2007-07-19 10:04:49 -07:00
[PATCH] lockdep: more chains
2006-12-07 08:39:43 -08:00
Fix leak on /proc/lockdep_stats
2007-07-31 15:39:40 -07:00
user namespace: add the framework
2007-07-16 09:05:47 -07:00
Fix Off-by-one in /sys/module/*/refcnt
2007-08-22 14:35:35 -07:00
[PATCH] remove many unneeded #includes of sched.h
2007-02-14 08:09:54 -08:00
[PATCH] lockdep: better lock debugging
2006-07-03 15:27:01 -07:00
lockstat: measure lock bouncing
2007-07-19 10:04:49 -07:00
[PATCH] lockdep: prove mutex locking correctness
2006-07-03 15:27:04 -07:00
mm: Remove slab destructors from kmem_cache_create().
2007-07-20 10:11:58 +09:00
Report that kernel is tainted if there was an OOPS
2007-07-17 10:23:02 -07:00
modules: better error messages when modules fail to load due to a sysfs problem.
2007-07-30 14:25:23 -07:00
namespace: ensure clone_flags are always stored in an unsigned long
2007-07-16 09:05:48 -07:00
sched: make posix-cpu-timers use CFS's accounting information
2007-07-09 18:51:58 +02:00
posix-timers: fix creation race
2007-08-22 19:52:46 -07:00
fix - ensure we don't use bootconsoles after init has been released
2007-08-21 20:23:53 -07:00
fix compilation with gcc 4.2
2007-08-11 15:47:42 -07:00
coredump masking: reimplementation of dumpable using two flags
2007-07-19 10:04:46 -07:00
Add suspend-related notifications for CPU hotplug
2007-05-09 12:30:56 -07:00
Freezer: make kernel threads nonfreezable by default
2007-07-17 10:23:02 -07:00
Fix a use after free bug in kernel->userspace relay file support
2007-07-31 15:39:42 -07:00
libata/IDE: remove combined mode quirk
2007-04-28 14:15:59 -04:00
FUTEX: Tidy up the code
2007-07-16 09:05:49 -07:00
[PATCH] lockdep: better lock debugging
2006-07-03 15:27:01 -07:00
Freezer: make kernel threads nonfreezable by default
2007-07-17 10:23:02 -07:00
FUTEX: Tidy up the code
2007-07-16 09:05:49 -07:00
[PATCH] lockdep: better lock debugging
2006-07-03 15:27:01 -07:00
FUTEX: Tidy up the code
2007-07-16 09:05:49 -07:00
lockstat: hook into spinlock_t, rwlock_t, rwsem and mutex
2007-07-19 10:04:49 -07:00
sched: s/sched_latency/sched_min_granularity
2007-08-25 22:17:19 +02:00
sched: sched_clock_idle_[sleep|wakeup]_event()
2007-08-23 15:18:02 +02:00
sched: cleanup, sched_granularity -> sched_min_granularity
2007-08-25 18:41:53 +02:00
sched: remove the 'u64 now' parameter from ->put_prev_task()
2007-08-09 11:16:49 +02:00
sched: optimize task_tick_rt() a bit
2007-08-24 20:39:10 +02:00
[PATCH] sched: add schedstat_set() API
2007-08-02 17:41:40 +02:00
make seccomp zerocost in schedule
2007-07-16 09:05:50 -07:00
sigqueue_free: fix the race with collect_signal()
2007-08-31 01:42:23 -07:00
Freezer: make kernel threads nonfreezable by default
2007-07-17 10:23:02 -07:00
Freezer: make kernel threads nonfreezable by default
2007-07-17 10:23:02 -07:00
lockstat: hook into spinlock_t, rwlock_t, rwsem and mutex
2007-07-19 10:04:49 -07:00
[PATCH] SRCU: report out-of-memory errors
2006-10-04 07:55:30 -07:00
[PATCH] lockdep: stacktrace subsystem, core
2006-07-03 15:27:02 -07:00
Fix stop_machine_run problem with naughty real time process
2007-07-16 09:05:41 -07:00
setpgid(child) fails if the child was forked by sub-thread
2007-08-31 01:42:22 -07:00
diskquota: 32bit quota tools on 64bit architectures
2007-07-16 09:05:48 -07:00
sched: cleanup, sched_granularity -> sched_min_granularity
2007-08-25 18:41:53 +02:00
taskstats: add context-switch counters
2007-07-16 09:05:46 -07:00
Cleanup non-arch xtime uses, use get_seconds() or current_kernel_time().
2007-07-25 10:09:20 -07:00
Pull ia64-clocksource into release branch
2007-07-20 11:26:47 -07:00
Cleanup non-arch xtime uses, use get_seconds() or current_kernel_time().
2007-07-25 10:09:20 -07:00
header cleaning: don't include smp_lock.h when not used
2007-05-08 11:15:07 -07:00
mm: Remove slab destructors from kmem_cache_create().
2007-07-20 10:11:58 +09:00
userns: don't leak root user
2007-08-31 01:42:23 -07:00
namespace: ensure clone_flags are always stored in an unsigned long
2007-07-16 09:05:48 -07:00
remove CONFIG_UTS_NS and CONFIG_IPC_NS
2007-07-16 09:05:47 -07:00
Fix occurrences of "the the "
2007-05-09 08:57:56 +02:00
fix bogus hotplug cpu warning
2007-08-27 10:27:48 -07:00
60187d2708