This is another attempt trying to make pidfd polling for multi-threaded
exec and premature thread-group leader exit consistent.
A quick recap of these two cases:
(1) During a multi-threaded exec by a subthread, i.e., non-thread-group
leader thread, all other threads in the thread-group including the
thread-group leader are killed and the struct pid of the
thread-group leader will be taken over by the subthread that called
exec. IOW, two tasks change their TIDs.
(2) A premature thread-group leader exit means that the thread-group
leader exited before all of the other subthreads in the thread-group
have exited.
Both cases lead to inconsistencies for pidfd polling with PIDFD_THREAD.
Any caller that holds a PIDFD_THREAD pidfd to the current thread-group
leader may or may not see an exit notification on the file descriptor
depending on when poll is performed. If the poll is performed before the
exec of the subthread has concluded an exit notification is generated
for the old thread-group leader. If the poll is performed after the exec
of the subthread has concluded no exit notification is generated for the
old thread-group leader.
The correct behavior would be to simply not generate an exit
notification on the struct pid of a subhthread exec because the struct
pid is taken over by the subthread and thus remains alive.
But this is difficult to handle because a thread-group may exit
prematurely as mentioned in (2). In that case an exit notification is
reliably generated but the subthreads may continue to run for an
indeterminate amount of time and thus also may exec at some point.
So far there was no way to distinguish between (1) and (2) internally.
This tiny series tries to address this problem by discarding
PIDFD_THREAD notification on premature thread-group leader exit.
If that works correctly then no exit notifications are generated for a
PIDFD_THREAD pidfd for a thread-group leader until all subthreads have
been reaped. If a subthread should exec aftewards no exit notification
will be generated until that task exits or it creates subthreads and
repeates the cycle.
Co-Developed-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx>
---
fs/pidfs.c | 22 +++++++++++++++++++++-
kernel/exit.c | 12 +++++++++---
kernel/signal.c | 6 ++++--
3 files changed, 34 insertions(+), 6 deletions(-)
diff --git a/fs/pidfs.c b/fs/pidfs.c
index a48cc44ced6f..f1c49a7540f3 100644
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -218,12 +218,32 @@ static __poll_t pidfd_poll(struct file *file, struct poll_table_struct *pts)
/*
* Depending on PIDFD_THREAD, inform pollers when the thread
* or the whole thread-group exits.
+ *
+ * There are two corner cases to consider:
+ *
+ * (1) If a thread-group leader of a thread-group with
+ * subthreads exits prematurely, i.e., before all of the
+ * subthreads of the thread-group have exited then no
+ * notification will be generated for PIDFD_THREAD pidfds
+ * referring to the thread-group leader.
+ *
+ * The exit notification for the thread-group leader will be
+ * delayed until the last subthread of the thread-group
+ * exits.
+ *
+ * (2) If a subthread of a thread-group execs then the
+ * current thread-group leader will be SIGKILLed and the
+ * subthread will assume the struct pid of the now defunct
+ * old thread-group leader. No exit notification will be
+ * generated for PIDFD_THREAD pidfds referring to the old
+ * thread-group leader as they continue referring to the new
+ * thread-group leader.
*/
guard(rcu)();
task = pid_task(pid, PIDTYPE_PID);
if (!task)
poll_flags = EPOLLIN | EPOLLRDNORM | EPOLLHUP;
- else if (task->exit_state && (thread || thread_group_empty(task)))
+ else if (task->exit_state && !delay_group_leader(task))
poll_flags = EPOLLIN | EPOLLRDNORM;
return poll_flags;
diff --git a/kernel/exit.c b/kernel/exit.c
index 9916305e34d3..ce5cdad5ba9c 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -271,6 +271,9 @@ void release_task(struct task_struct *p)
* If we were the last child thread and the leader has
* exited already, and the leader's parent ignores SIGCHLD,
* then we are the one who should release the leader.
+ *
+ * This will also wake PIDFD_THREAD pidfds for the
+ * thread-group leader that already exited.
*/
zap_leader = do_notify_parent(leader, leader->exit_signal);
if (zap_leader)
@@ -743,10 +746,13 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
tsk->exit_state = EXIT_ZOMBIE;
/*
- * sub-thread or delay_group_leader(), wake up the
- * PIDFD_THREAD waiters.
+ * Wake up PIDFD_THREAD waiters if this is a proper subthread
+ * exit. If this is a premature thread-group leader exit delay
+ * the notification until the last subthread exits. If a
+ * subthread should exec before then no notification will be
+ * generated.
*/
- if (!thread_group_empty(tsk))
+ if (!delay_group_leader(tsk))
do_notify_pidfd(tsk);
if (unlikely(tsk->ptrace)) {
diff --git a/kernel/signal.c b/kernel/signal.c
index 081f19a24506..0ccef8783dff 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -2180,8 +2180,10 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
WARN_ON_ONCE(!tsk->ptrace &&
(tsk->group_leader != tsk || !thread_group_empty(tsk)));
/*
- * tsk is a group leader and has no threads, wake up the
- * non-PIDFD_THREAD waiters.
+ * This is a thread-group leader without subthreads so wake up
+ * the non-PIDFD_THREAD waiters. This also wakes the
+ * PIDFD_THREAD waiters for the thread-group leader in case it
+ * exited prematurely from release_task().
*/
if (thread_group_empty(tsk))
do_notify_pidfd(tsk);
--
2.47.2
