• Alexander Nyberg's avatar
    [PATCH] Fix fs/exec.c:788 (de_thread()) BUG_ON · fb085cf1
    Alexander Nyberg authored
    It turns out that the BUG_ON() in fs/exec.c: de_thread() is unreliable
    and can trigger due to the test itself being racy.
    
    de_thread() does
     	while (atomic_read(&sig->count) > count) {
    	}
    	.....
    	.....
    	BUG_ON(!thread_group_empty(current));
    
    but release_task does
    	write_lock_irq(&tasklist_lock)
    	__exit_signal
    		(this is where atomic_dec(&sig->count) is run)
    	__exit_sighand
    	__unhash_process
    		takes write lock on tasklist_lock
    		remove itself out of PIDTYPE_TGID list
    	write_unlock_irq(&tasklist_lock)
    
    so there's a clear (although small) window between the
    atomic_dec(&sig->count) and the actual PIDTYPE_TGID unhashing of the
    thread.
    
    And actually there is no need for all threads to have exited at this
    point, so we simply kill the BUG_ON.
    
    Big thanks to Marc Lehmann who provided the test-case.
    
    Fixes Bug 5170 (http://bugme.osdl.org/show_bug.cgi?id=5170)
    Signed-off-by: default avatarAlexander Nyberg <alexn@telia.com>
    Cc: Roland McGrath <roland@redhat.com>
    Cc: Andrew Morton <akpm@osdl.org>
    Cc: Ingo Molnar <mingo@elte.hu>
    Acked-by: default avatarAndi Kleen <ak@suse.de>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    fb085cf1
exec.c 34.6 KB