lkml.org 
[lkml]   [2011]   [Jul]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH 1/1] ptrace: do_wait(traced_leader_killed_by_mt_exec) can block forever
Test-case:

void *tfunc(void *arg)
{
execvp("true", NULL);
return NULL;
}

int main(void)
{
int pid;

if (fork()) {
pthread_t t;

kill(getpid(), SIGSTOP);

pthread_create(&t, NULL, tfunc, NULL);

for (;;)
pause();
}

pid = getppid();
assert(ptrace(PTRACE_ATTACH, pid, 0,0) == 0);

while (wait(NULL) > 0)
ptrace(PTRACE_CONT, pid, 0,0);

return 0;
}

It is racy, exit_notify() does __wake_up_parent() too. But in the
likely case it triggers the problem: de_thread() does release_task()
and the old leader goes away without the notification, the tracer
sleeps in do_wait() without children/tracees.

Change de_thread() to do __wake_up_parent(traced_leader->parent).
Since it is already EXIT_DEAD we can do this without ptrace_unlink(),
EXIT_DEAD threads do not exist from do_wait's pov.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
---

fs/exec.c | 8 ++++++++
1 file changed, 8 insertions(+)

--- ptrace/fs/exec.c~ptrace_mt_exec_wait_hang 2011-07-17 20:16:36.000000000 +0200
+++ ptrace/fs/exec.c 2011-07-21 19:56:22.000000000 +0200
@@ -967,6 +967,14 @@ static int de_thread(struct task_struct

BUG_ON(leader->exit_state != EXIT_ZOMBIE);
leader->exit_state = EXIT_DEAD;
+
+ /*
+ * We are going to release_task()->ptrace_unlink() silently,
+ * the tracer can sleep in do_wait(). EXIT_DEAD guarantees
+ * the tracer wont't block again waiting for this thread.
+ */
+ if (unlikely(leader->ptrace))
+ __wake_up_parent(leader, leader->parent);
write_unlock_irq(&tasklist_lock);

release_task(leader);


\
 
 \ /
  Last update: 2011-07-21 20:05    [W:0.068 / U:0.436 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site