Commit 5fa534c9 authored by Oleg Nesterov's avatar Oleg Nesterov Committed by Linus Torvalds
Browse files

coredump: ensure all coredumping tasks have SIGNAL_GROUP_COREDUMP

task_will_free_mem() is wrong in many ways, and in particular the
SIGNAL_GROUP_COREDUMP check is not reliable: a task can participate in the
coredumping without SIGNAL_GROUP_COREDUMP bit set.

change zap_threads() paths to always set SIGNAL_GROUP_COREDUMP even if
other CLONE_VM processes can't react to SIGKILL.  Fortunately, at least
oom-kill case if fine; it kills all tasks sharing the same mm, so it
should also kill the process which actually dumps the core.

The change in prepare_signal() is not strictly necessary, it just ensures
that the patch does not bring another subtle behavioural change.  But it
reminds us that this SIGNAL_GROUP_EXIT/COREDUMP case needs more changes.
Signed-off-by: default avatarOleg Nesterov <>
Cc: David Rientjes <>
Cc: Kyle Walker <>
Acked-by: default avatarMichal Hocko <>
Cc: Stanislav Kozina <>
Cc: Tetsuo Handa <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent 9317bb96
......@@ -280,11 +280,13 @@ out:
return ispipe;
static int zap_process(struct task_struct *start, int exit_code)
static int zap_process(struct task_struct *start, int exit_code, int flags)
struct task_struct *t;
int nr = 0;
/* ignore all signals except SIGKILL, see prepare_signal() */
start->signal->flags = SIGNAL_GROUP_COREDUMP | flags;
start->signal->group_exit_code = exit_code;
start->signal->group_stop_count = 0;
......@@ -311,10 +313,8 @@ static int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
if (!signal_group_exit(tsk->signal)) {
mm->core_state = core_state;
nr = zap_process(tsk, exit_code);
tsk->signal->group_exit_task = tsk;
/* ignore all signals except SIGKILL, see prepare_signal() */
tsk->signal->flags = SIGNAL_GROUP_COREDUMP;
nr = zap_process(tsk, exit_code, 0);
clear_tsk_thread_flag(tsk, TIF_SIGPENDING);
......@@ -365,8 +365,8 @@ static int zap_threads(struct task_struct *tsk, struct mm_struct *mm,
if (p->mm) {
if (unlikely(p->mm == mm)) {
lock_task_sighand(p, &flags);
nr += zap_process(p, exit_code);
p->signal->flags = SIGNAL_GROUP_EXIT;
nr += zap_process(p, exit_code,
unlock_task_sighand(p, &flags);
......@@ -788,7 +788,7 @@ static bool prepare_signal(int sig, struct task_struct *p, bool force)
sigset_t flush;
if (signal->flags & SIGNAL_GROUP_COREDUMP)
if (!(signal->flags & SIGNAL_GROUP_EXIT))
return sig == SIGKILL;
* The process is in the middle of dying, nothing to do.
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment