Oleg Nesterov da7978b034 signals: fix sigqueue_free() vs __exit_signal() race
__exit_signal() does flush_sigqueue(tsk->pending) outside of ->siglock.
This can race with another thread doing sigqueue_free(), we can free the
same SIGQUEUE_PREALLOC sigqueue twice or corrupt the pending->list.

Note that even sys_exit_group() can trigger this race, not only
sys_timer_delete().

Move the callsite of flush_sigqueue(tsk->pending) under ->siglock.

This patch doesn't touch flush_sigqueue(->shared_pending) below, it is
called when there are no other threads which can play with signals, and
sigqueue_free() can't be used outside of our thread group.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Acked-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-05-24 09:56:10 -07:00
..
2008-05-01 08:03:59 -07:00
2008-05-16 17:22:26 -04:00
2008-03-30 14:18:41 -07:00
2008-05-05 08:18:45 -07:00
2008-01-25 21:08:29 +01:00
2007-07-16 09:05:50 -07:00
2008-05-14 19:11:14 -07:00
2008-05-01 13:08:16 -04:00
2008-04-30 08:29:48 -07:00
2008-04-30 08:29:49 -07:00
2008-02-08 09:22:31 -08:00
2008-04-29 08:05:59 -07:00
2008-04-30 08:29:48 -07:00
2008-05-01 08:03:58 -07:00
2008-05-01 10:21:54 -07:00
2008-01-25 21:08:24 +01:00
2008-02-13 16:21:18 -08:00
2008-01-25 21:08:24 +01:00
2008-05-08 14:06:19 +02:00
2008-05-08 17:00:42 +02:00
2008-04-19 19:45:00 +02:00
2008-05-05 23:56:18 +02:00
2008-05-14 19:11:14 -07:00
2007-07-16 09:05:50 -07:00
2008-05-10 20:43:22 -07:00
2008-01-30 13:31:20 +01:00
2008-02-06 10:41:02 -08:00
2008-02-05 09:44:07 -08:00
2008-04-30 08:29:48 -07:00
2008-04-30 08:29:53 -07:00
2008-02-08 09:22:31 -08:00