Merge tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull signal handling updates from Christian Brauner:
 "This stops TIF_NOTIFY_SIGNAL from interrupting work that can't be
  restarted and fixes a bunch of coredump and signal bugs.

  TIF_NOTIFY_SIGNAL kicks a task out of an uninterruptible sleep so it
  returns to userspace, runs its task work and goes back to sleep. That
  breaks coredumps: dump_interrupted() only lets fatal signals interrupt
  a dump and writes to a regular file ignore TIF_NOTIFY_SIGNAL. But the
  pipe and the socket paths check signal_pending() Adeep down in code
  that is shared with regular syscalls and bail. So a crashing process
  with io_uring requests in flight loses most of its coredump.

  In the selftest an unfixed kernel delivers 357324 of at least 5111808
  bytes. And io_uring isn't the only source. klp_send_signals(),
  bpf_task_work_schedule_signal(), landlock's tsync, kthread_stop() and
  the printk kunit test raise the bit as well, some of them from irq
  context against any task. So this can't be fixed per subsystem and the
  state has to be per-task and ambient.

  Add PF_NO_NOTIFY_SIGNAL and no_notify_signal_save()/restore() helpers
  modelled on memalloc_nofs_save(). Inside such a section
  signal_pending() ignores TIF_NOTIFY_SIGNAL. Coredumps, the smb send
  path, which hand-rolled its own version of this, and the pid namespace
  reaper, which busy-looped when the bit kept getting raised, are
  converted.

  The second part is a set of fixes that fell out of looking at the
  coredump code with kres and modelling it in TLA+:

  - coredump_finish() woke the parked threads without holding rcu. A
    parked thread can exit on a spurious wakeup and be freed before
    wake_up_process() takes its pi_lock.

  - Only SIGKILL and the freezers interrupt a dump now and the three
    freezers agree. Power management and cgroup v1 freezing aborted a
    dump while a cgroup v2 freeze either waited for the dump or cut it
    short depending on where the core went.

  - io-wq set its exit bit without a barrier against the task work that
    creates workers. On weakly ordered architectures exit could hang on
    worker_done.

  - retarget_shared_pending() slingshotted a shared signal to the dumper
    when a zapped sibling restored its signal mask. That set
    TIF_SIGPENDING on the dumper and truncated the core.

  - A tracer could clear the signal mask of a user worker with
    PTRACE_SETSIGMASK and inject a coredump signal. An io-wq worker of
    an SQPOLL ring dumping core deadlocks the whole group.
    PTRACE_SETSIGMASK is refused for user workers now and
    __set_task_blocked() enforces the fork-time mask.

  - exec cancels io_uring requests before de_thread() so a worker
    creation queued as task work can't add a thread to a thread group
    that de_thread() just took down.

  - No io threads are created from a PF_SIGNALED or PF_POSTCOREDUMP
    creator anymore. Such a worker was invisible to zap_process() but
    still decremented threads_remaining on exit so the dumper could
    leave coredump_wait_inactive() early.

  Also included are a comment that do_each_pid_task() needs
  tasklist_lock, a READ_ONCE() in pid_alive() and a regression test for
  fork() into a pid namespace whose ancestor lost its init"

* tag 'kernel-7.4-rc1.signal' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (21 commits)
  pid: use READ_ONCE() in pid_alive()
  selftests: pid_namespace: test fork with dead ancestor
  pid: document that do_each_pid_task() needs tasklist_lock
  signal: enforce the user worker signal mask in __set_task_blocked()
  fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
  fork: don't create io threads once PF_POSTCOREDUMP is set
  fork: move the coredump and exec checks into create_io_thread()
  exec: cancel io_uring requests before de_thread()
  selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
  selftests/coredump: test a user worker as the coredumping thread
  ptrace: refuse to change the signal mask of a user worker
  selftests/coredump: test shared signal retargeting during a dump
  signal: only SIGKILL and the freezers interrupt a coredumping task
  signal: don't retarget shared signals in a dying thread group
  io-wq: order the exit bit against worker creation task work
  coredump: hold RCU while releasing parked threads
  pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
  smb: prevent TIF_NOTIFY_SIGNAL from interrupting
  selftests/coredump: test that TIF_NOTIFY_SIGNAL doesn't truncate a coredump
  coredump: prevent TIF_NOTIFY_SIGNAL from interrupting coredumps
  ...

0 files changed, 0 insertions, 0 deletions