Currently, exit_ptrace() adds all ptraced tasks in a dead list, than zap_pid_ns_processes() waits all tasks in a current pid ns, and only then tasks from the dead list are released.
zap_pid_ns_processes() can stuck on waiting tasks from the dead list. In this case, we will have one unkillable process with one or more dead children. Cc: Oleg Nesterov <[email protected]> Cc: "Eric W. Biederman" <[email protected]> Cc: Andrew Morton <[email protected]> Signed-off-by: Andrei Vagin <[email protected]> --- kernel/exit.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/kernel/exit.c b/kernel/exit.c index 0e21e6d21f35..ccaa6f6549ba 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -664,9 +664,6 @@ static void forget_original_parent(struct task_struct *father, { struct task_struct *p, *t, *reaper; - if (unlikely(!list_empty(&father->ptraced))) - exit_ptrace(father, dead); - /* Can drop and reacquire tasklist_lock */ reaper = find_child_reaper(father); if (list_empty(&father->children)) @@ -705,8 +702,18 @@ static void exit_notify(struct task_struct *tsk, int group_dead) LIST_HEAD(dead); write_lock_irq(&tasklist_lock); - forget_original_parent(tsk, &dead); + if (unlikely(!list_empty(&tsk->ptraced))) + exit_ptrace(tsk, &dead); + write_unlock_irq(&tasklist_lock); + + /* Ptraced tasks have to be released before zap_pid_ns_processes(). */ + list_for_each_entry_safe(p, n, &dead, ptrace_entry) { + list_del_init(&p->ptrace_entry); + release_task(p); + } + write_lock_irq(&tasklist_lock); + forget_original_parent(tsk, &dead); if (group_dead) kill_orphaned_pgrp(tsk->group_leader, NULL); -- 2.17.2
