The patch titled Subject: proc-report-eip-and-esp-for-all-threads-when-coredumping-fix-2 has been added to the -mm tree. Its filename is proc-report-eip-and-esp-for-all-threads-when-coredumping-fix-2.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/proc-report-eip-and-esp-for-all-threads-when-coredumping-fix-2.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/proc-report-eip-and-esp-for-all-threads-when-coredumping-fix-2.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: John Ogness <john.ogness@xxxxxxxxxxxxx> Subject: proc-report-eip-and-esp-for-all-threads-when-coredumping-fix-2 > * a program is not able to use ptrace(2) in that case. It is > * safe because the task has stopped executing permanently. > */ > - if (permitted && (task->flags & PF_DUMPCORE)) { > + if (permitted && (!!mm->core_state)) { This is not entirely safe. mm->core_state is set _before_ zap_process() is called. Therefore tasks can be executing on a CPU with mm->core_state set. With the following additional change, I was able to close the window. Link: http://lkml.kernel.org/r/875zpzif8v.fsf@xxxxxxxxxxxxx Cc: Alexey Dobriyan <adobriyan@xxxxxxxxx> Cc: Andy Lutomirski <luto@xxxxxxxxxx> Cc: Jan Luebbe <jlu@xxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/coredump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/coredump.c~proc-report-eip-and-esp-for-all-threads-when-coredumping-fix-2 +++ a/fs/coredump.c @@ -340,10 +340,10 @@ static int zap_threads(struct task_struc spin_lock_irq(&tsk->sighand->siglock); if (!signal_group_exit(tsk->signal)) { - mm->core_state = core_state; tsk->signal->group_exit_task = tsk; nr = zap_process(tsk, exit_code, 0); clear_tsk_thread_flag(tsk, TIF_SIGPENDING); + mm->core_state = core_state; } spin_unlock_irq(&tsk->sighand->siglock); if (unlikely(nr < 0)) _ Patches currently in -mm which might be from john.ogness@xxxxxxxxxxxxx are proc-report-eip-and-esp-for-all-threads-when-coredumping-fix-2.patch