• Oleg Nesterov's avatar
    wait: fix reparent_leader() vs EXIT_DEAD->EXIT_ZOMBIE race · d66d2078
    Oleg Nesterov authored
    commit dfccbb5e upstream.
    
    wait_task_zombie() first does EXIT_ZOMBIE->EXIT_DEAD transition and
    drops tasklist_lock.  If this task is not the natural child and it is
    traced, we change its state back to EXIT_ZOMBIE for ->real_parent.
    
    The last transition is racy, this is even documented in 50b8d257
    "ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD->EXIT_ZOMBIE
    race".  wait_consider_task() tries to detect this transition and clear
    ->notask_error but we can't rely on ptrace_reparented(), debugger can
    exit and do ptrace_unlink() before its sub-thread sets EXIT_ZOMBIE.
    
    And there is another problem which were missed before: this transition
    can also race with reparent_leader() which doesn't reset >exit_signal if
    EXIT_DEAD, assuming that this task must be reaped by someone else.  So
    the tracee can be re-parented with ->exit_signal != SIGCHLD, and if
    /sbin/init doesn't use __WALL it becomes unreapable.
    
    Change reparent_leader() to update ->exit_signal even if EXIT_DEAD.
    Note: this is the simple temporary hack for -stable, it doesn't try to
    solve all problems, it will be reverted by the next changes.
    Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
    Reported-by: default avatarJan Kratochvil <jan.kratochvil@redhat.com>
    Reported-by: default avatarMichal Schmidt <mschmidt@redhat.com>
    Tested-by: default avatarMichal Schmidt <mschmidt@redhat.com>
    Cc: Al Viro <viro@ZenIV.linux.org.uk>
    Cc: Lennart Poettering <lpoetter@redhat.com>
    Cc: Roland McGrath <roland@hack.frob.com>
    Cc: Tejun Heo <tj@kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    d66d2078
exit.c 47.4 KB