Re: [patch 1/8] signal: Prevent exec() race

[Frederic Weisbecker <frederic@kernel.org>]

Le Sat, Sep 05, 2026 at 09:34:52AM +0200, Thomas Gleixner a écrit :
> On Fri, Sep 04 2026 at 13:35, Oleg Nesterov wrote:
> > Thomas, I can't read this series today, will try on Weekend.
> >
> > But you didn't reply to
> > https://lore.kernel.org/all/apgHJj0qH7HlAXKO@redhat.com/
> > Let me quote that email here:
> >
> > 	OK... lets suppose the exiting task T passes exit_signals().
> >
> > 	Suppose we have an "ignored" timer tmr. Another sub-thread calls
> > 	do_sigaction() -> posixtimer_sig_unignore() and finds that tmr
> > 	in ->ignored_posix_timers list.
> >
> > 	But posixtimer_queue_sigqueue() doesn't check PF_EXITING, I guess
> > 	it should check it too?
> 
> From the patch:
> 
> @@ -1990,6 +2004,9 @@ void posixtimer_send_sigqueue(struct k_i
> 	if (!likely(lock_task_sighand(t, &flags)))
> 		return;
> 
> +	if (unlikely(tmr->it_pid_type == PIDTYPE_PID && (t->flags & PF_EXITING)))
> +		goto unlock;
> +

But posixtimer_sig_unignore() calls directly posixtimer_queue_sigqueue(), not
posixtimer_send_sigqueue().

However posixtimer_queue_sigqueue() -> complete_signal() -> wants_signal()
checks PF_EXITING and complete_signal() then just drops it.

Ah but doesn't that leak a refcount drop? Looks like the PF_EXITING check should
indeed move to posixtimer_get_target().

Thanks.

-- 
Frederic Weisbecker
SUSE Labs