Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

reparent_thread: fix a zombie leak if /sbin/init ignores SIGCHLD

Browse source 
If /sbin/init ignores SIGCHLD and we re-parent a zombie, it is leaked.
reparent_thread() does do_notify_parent() which sets ->exit_signal = -1 in
this case.  This means that nobody except us can reap it, the detached
task is not visible to do_wait().

Change reparent_thread() to return a boolean (like __pthread_detach) to
indicate that the thread is dead and must be released.  Also change
forget_original_parent() to add the child to ptrace_dead list in this
case.

The naming becomes insane, the next patch does the cleanup.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: Roland McGrath <roland@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Oleg Nesterov 2009-04-02 16:58:17 -07:00 committed by Linus Torvalds
parent b1442b055c
commit 7f5d3652d4
1 changed files with 17 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
kernel/exit.c
View file

@ -810,8 +810,11 @@ static void ptrace_exit_finish(struct task_struct *parent,
} }
} }
static void reparent_thread(struct task_struct *p, struct task_struct *father) /* Returns nonzero if the child should be released. */
static int reparent_thread(struct task_struct *p, struct task_struct *father)
{ {
int dead;
if (p->pdeath_signal) if (p->pdeath_signal)
/* We already hold the tasklist_lock here. */ /* We already hold the tasklist_lock here. */
group_send_sig_info(p->pdeath_signal, SEND_SIG_NOINFO, p); group_send_sig_info(p->pdeath_signal, SEND_SIG_NOINFO, p);
@ -819,12 +822,12 @@ static void reparent_thread(struct task_struct *p, struct task_struct *father)
list_move_tail(&p->sibling, &p->real_parent->children); list_move_tail(&p->sibling, &p->real_parent->children);
if (task_detached(p)) if (task_detached(p))
return; return 0;
/* If this is a threaded reparent there is no need to /* If this is a threaded reparent there is no need to
* notify anyone anything has happened. * notify anyone anything has happened.
*/ */
if (same_thread_group(p->real_parent, father)) if (same_thread_group(p->real_parent, father))
return; return 0;
/* We don't want people slaying init. */ /* We don't want people slaying init. */
p->exit_signal = SIGCHLD; p->exit_signal = SIGCHLD;
@ -832,11 +835,19 @@ static void reparent_thread(struct task_struct *p, struct task_struct *father)
/* If we'd notified the old parent about this child's death, /* If we'd notified the old parent about this child's death,
* also notify the new parent. * also notify the new parent.
*/ */
dead = 0;
if (!p->ptrace && if (!p->ptrace &&
p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) p->exit_state == EXIT_ZOMBIE && thread_group_empty(p)) {
do_notify_parent(p, p->exit_signal); do_notify_parent(p, p->exit_signal);
if (task_detached(p)) {
p->exit_state = EXIT_DEAD;
dead = 1;
}
}
kill_orphaned_pgrp(p, father); kill_orphaned_pgrp(p, father);
return dead;
} }
/* /*
@ -896,7 +907,8 @@ static void forget_original_parent(struct task_struct *father)
BUG_ON(p->ptrace); BUG_ON(p->ptrace);
p->parent = p->real_parent; p->parent = p->real_parent;
} }
reparent_thread(p, father); if (reparent_thread(p, father))
list_add(&p->ptrace_entry, &ptrace_dead);;
} }
write_unlock_irq(&tasklist_lock); write_unlock_irq(&tasklist_lock);