lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sat, 13 Oct 2007 15:48:20 +0400
From:	Oleg Nesterov <>
To:	Andrew Morton <>
Cc:	Mathieu Desnoyers <>,,,,,, Pavel Emelyanov <>,
	Sukadev Bhattiprolu <>,
	Paul Menage <>,
	"Eric W. Biederman" <>
Subject: Re: 2.6.23-mm1 thread exit_group issue

On 10/12, Andrew Morton wrote:
> On Fri, 12 Oct 2007 15:47:59 -0400
> Mathieu Desnoyers <> wrote:
> > Hi Andrew,
> > 
> > I noticed a regression between 2.6.23-rc8-mm2 and 2.6.23-mm1 (with your
> > hotfixes). User space threads seems to receive a ERESTART_RESTARTBLOCK
> > as soon as a thread does a pthread_join on them. The previous behavior
> > was to wait for them to exit by taking a futex.

No, the reason is that pthread_join() succeeds while it shouldn't. The main
thread does exit_group() and kills the sub-thread sleeping in nanosleep.
ERESTART_RESTARTBLOCK is not delivered to the user-space (sub-thread is dying),
it is just reported by gdb.

> > I provide a toy program that shows the problem. On 2.6.23-rc8-mm2, it
> > loops forever (as it should). On 2.6.23-mm1, it exits after 10 seconds.

I bet something like this

	void *threda(void *arg)
		for (;;)
		return NULL;

	int main(void)
		pthread_t tid;

		pthread_create(&tid, NULL, thread, NULL);
		pthread_join(tid, NULL);

		return 0;

won't work as well.

> > Any idea on what may cause this problem ?

Because do_fork() doesn't use parent_tidptr. At all! So it is very clear
why 2.6.23-mm1 is broken.

> Bisection shows that this problem is caused by these two patches:
> pid-namespaces-allow-cloning-of-new-namespace.patch


Pavel, this patch has a subtle difference compared to what we discussed on
containers list. It moves put_user(parent_tidptr) from copy_process() to
do_fork(), so we don't report child's pid if copy_process() failed. I do
not think this is bad, but Eric seems to disagree with such a change.

But I can't understand why Andrew sees the same problem _after_ this patch!

And which patch removed the "put_user(nr, parent_tidptr)" chunk?

Andrew, could I get the kernel source after bisection somehow? (I am not
familiar with guilt, will try to study it later)

Mathieu, could you try the patch below?


--- kernel/fork.c~	2007-10-13 15:41:35.000000000 +0400
+++ kernel/fork.c	2007-10-13 15:41:41.000000000 +0400
@@ -1443,6 +1443,9 @@ long do_fork(unsigned long clone_flags,
 			task_pid_nr_ns(p, current->nsproxy->pid_ns) :
+		if (clone_flags & CLONE_PARENT_SETTID)
+			put_user(nr, parent_tidptr);
 		if (clone_flags & CLONE_VFORK) {
 			p->vfork_done = &vfork;

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists