Skip to content

Commit ea6d290

Browse files
oleg-nesterovtorvalds
authored andcommitted
signals: make task_struct->signal immutable/refcountable
We have a lot of problems with accessing task_struct->signal, it can "disappear" at any moment. Even current can't use its ->signal safely after exit_notify(). ->siglock helps, but it is not convenient, not always possible, and sometimes it makes sense to use task->signal even after this task has already dead. This patch adds the reference counter, sigcnt, into signal_struct. This reference is owned by task_struct and it is dropped in __put_task_struct(). Perhaps it makes sense to export get/put_signal_struct() later, but currently I don't see the immediate reason. Rename __cleanup_signal() to free_signal_struct() and unexport it. With the previous changes it does nothing except kmem_cache_free(). Change __exit_signal() to not clear/free ->signal, it will be freed when the last reference to any thread in the thread group goes away. Note: - when the last thead exits signal->tty can point to nowhere, see the next patch. - with or without this patch signal_struct->count should go away, or at least it should be "int nr_threads" for fs/proc. This will be addressed later. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Cc: Alan Cox <alan@linux.intel.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Peter Zijlstra <peterz@infradead.org> Acked-by: Roland McGrath <roland@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 4dec2a9 commit ea6d290

File tree

3 files changed

+17
-11
lines changed

3 files changed

+17
-11
lines changed

include/linux/sched.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -527,6 +527,7 @@ struct thread_group_cputimer {
527527
* the locking of signal_struct.
528528
*/
529529
struct signal_struct {
530+
atomic_t sigcnt;
530531
atomic_t count;
531532
atomic_t live;
532533

@@ -2101,7 +2102,6 @@ extern void flush_thread(void);
21012102
extern void exit_thread(void);
21022103

21032104
extern void exit_files(struct task_struct *);
2104-
extern void __cleanup_signal(struct signal_struct *);
21052105
extern void __cleanup_sighand(struct sighand_struct *);
21062106

21072107
extern void exit_itimers(struct signal_struct *);

kernel/exit.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,6 @@ static void __exit_signal(struct task_struct *tsk)
134134
* doing sigqueue_free() if we have SIGQUEUE_PREALLOC signals.
135135
*/
136136
flush_sigqueue(&tsk->pending);
137-
138-
tsk->signal = NULL;
139137
tsk->sighand = NULL;
140138
spin_unlock(&sighand->siglock);
141139

@@ -150,7 +148,6 @@ static void __exit_signal(struct task_struct *tsk)
150148
*/
151149
task_rq_unlock_wait(tsk);
152150
tty_kref_put(sig->tty);
153-
__cleanup_signal(sig);
154151
}
155152
}
156153

kernel/fork.c

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,18 @@ void free_task(struct task_struct *tsk)
165165
}
166166
EXPORT_SYMBOL(free_task);
167167

168+
static inline void free_signal_struct(struct signal_struct *sig)
169+
{
170+
thread_group_cputime_free(sig);
171+
kmem_cache_free(signal_cachep, sig);
172+
}
173+
174+
static inline void put_signal_struct(struct signal_struct *sig)
175+
{
176+
if (atomic_dec_and_test(&sig->sigcnt))
177+
free_signal_struct(sig);
178+
}
179+
168180
void __put_task_struct(struct task_struct *tsk)
169181
{
170182
WARN_ON(!tsk->exit_state);
@@ -173,6 +185,7 @@ void __put_task_struct(struct task_struct *tsk)
173185

174186
exit_creds(tsk);
175187
delayacct_tsk_free(tsk);
188+
put_signal_struct(tsk->signal);
176189

177190
if (!profile_handoff_task(tsk))
178191
free_task(tsk);
@@ -864,6 +877,7 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
864877
if (!sig)
865878
return -ENOMEM;
866879

880+
atomic_set(&sig->sigcnt, 1);
867881
atomic_set(&sig->count, 1);
868882
atomic_set(&sig->live, 1);
869883
init_waitqueue_head(&sig->wait_chldexit);
@@ -889,12 +903,6 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
889903
return 0;
890904
}
891905

892-
void __cleanup_signal(struct signal_struct *sig)
893-
{
894-
thread_group_cputime_free(sig);
895-
kmem_cache_free(signal_cachep, sig);
896-
}
897-
898906
static void copy_flags(unsigned long clone_flags, struct task_struct *p)
899907
{
900908
unsigned long new_flags = p->flags;
@@ -1248,6 +1256,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
12481256
}
12491257

12501258
if (clone_flags & CLONE_THREAD) {
1259+
atomic_inc(&current->signal->sigcnt);
12511260
atomic_inc(&current->signal->count);
12521261
atomic_inc(&current->signal->live);
12531262
p->group_leader = current->group_leader;
@@ -1294,7 +1303,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
12941303
mmput(p->mm);
12951304
bad_fork_cleanup_signal:
12961305
if (!(clone_flags & CLONE_THREAD))
1297-
__cleanup_signal(p->signal);
1306+
free_signal_struct(p->signal);
12981307
bad_fork_cleanup_sighand:
12991308
__cleanup_sighand(p->sighand);
13001309
bad_fork_cleanup_fs:

0 commit comments

Comments
 (0)