The patch titled do_wait: fix the theoretical race with stop/trace/cont has been added to the -mm tree. Its filename is do_wait-fix-the-theoretical-race-with-stop-trace-cont.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: do_wait: fix the theoretical race with stop/trace/cont From: Oleg Nesterov <oleg@xxxxxxxxxx> do_wait: current->state = TASK_INTERRUPTIBLE; read_lock(&tasklist_lock); ... search for the task to reap ... In theory, the ->state changing can leak into the critical section. Since the child can change its status under read_lock(tasklist) in parallel (finish_stop/ptrace_stop), we can miss the wakeup if __wake_up_parent() sees us in TASK_RUNNING state. Add the barrier. Also, use __set_current_state() to set TASK_RUNNING. Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx> Cc: Ingo Molnar <mingo@xxxxxxx> Acked-by: Roland McGrath <roland@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/exit.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff -puN kernel/exit.c~do_wait-fix-the-theoretical-race-with-stop-trace-cont kernel/exit.c --- a/kernel/exit.c~do_wait-fix-the-theoretical-race-with-stop-trace-cont +++ a/kernel/exit.c @@ -1587,7 +1587,7 @@ repeat: (!wo->wo_pid || hlist_empty(&wo->wo_pid->tasks[wo->wo_type]))) goto notask; - current->state = TASK_INTERRUPTIBLE; + set_current_state(TASK_INTERRUPTIBLE); read_lock(&tasklist_lock); tsk = current; do { @@ -1614,7 +1614,7 @@ notask: } } end: - current->state = TASK_RUNNING; + __set_current_state(TASK_RUNNING); remove_wait_queue(¤t->signal->wait_chldexit,&wait); if (wo->wo_info) { struct siginfo __user *infop = wo->wo_info; _ Patches currently in -mm which might be from oleg@xxxxxxxxxx are origin.patch linux-next.patch drivers-staging-epl-do-not-use-clone_sighand-with-allow_signal.patch slow_work_thread-should-do-the-exclusive-wait.patch rework-fix-is_single_threaded.patch getrusage-fill-ru_maxrss-value.patch allow_signal-kill-the-bogus-mm-check-add-a-note-about-clone_sighand.patch ptrace-remove-pt_dtrace-from-arch-h8300.patch ptrace-remove-pt_dtrace-from-avr32-mn10300-parisc-s390-sh-xtensa.patch ptrace-remove-pt_dtrace-from-m68k-m68knommu.patch ptrace-remove-pt_dtrace-from-arch-m32r.patch ptrace-mm_need_new_owner-use-real_parent-to-search-in-the-siblings.patch ptrace-tracehook_unsafe_exec-remove-the-stale-comment.patch ptrace-tracehook_unsafe_exec-remove-the-stale-comment-fix.patch ptrace-do-not-use-task-ptrace-directly-in-core-kernel.patch ptrace-ptrace_attach-check-pf_kthread-exit_state-instead-of-mm.patch ptrace-cleanup-check-set-of-pt_ptraced-during-attach.patch ptrace-do-not-use-task_lock-for-attach.patch ptrace_get_task_struct-s-tasklist-rcu-make-it-static.patch signals-tracehook_notify_jctl-change.patch utrace-core.patch copy_process-remove-the-unneeded-clear_tsk_thread_flagtif_sigpending.patch elf_core_dump-use-rcu_read_lock-to-access-real_parent.patch shift-ptrace-implies-wuntraced-from-ptrace_do_wait-to-wait_task_stopped.patch introduce-struct-wait_opts-to-simplify-do_wait-pathes.patch do_wait-simplify-retval-tsk_result-notask_error-mess.patch do_wait-kill-the-old-bug_on-use-while_each_thread.patch do_wait-fix-the-theoretical-race-with-stop-trace-cont.patch kthreads-simplify-the-startup-synchronization.patch kthreads-rework-kthread_stop.patch kthreads-simplify-migration_thread-exit-path.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html