kthread: fix boot hang (regression) on MIPS/OpenRISC

b0f5a8f3 · Vegard Nossum <[email protected]> · 2017-05-29 09:22:07 +02:00

This fixes a regression in commit 4d6501dce079 where I didn't notice
that MIPS and OpenRISC were reinitialising p->{set,clear}_child_tid to
NULL after our initialisation in copy_process().

We can simply get rid of the arch-specific initialisation here since it
is now always done in copy_process() before hitting copy_thread{,_tls}().

Review notes:

 - As far as I can tell, copy_process() is the only user of
   copy_thread_tls(), which is the only caller of copy_thread() for
   architectures that don't implement copy_thread_tls().

 - After this patch, there is no arch-specific code touching
   p->set_child_tid or p->clear_child_tid whatsoever.

 - It may look like MIPS/OpenRISC wanted to always have these fields be
   NULL, but that's not true, as copy_process() would unconditionally
   set them again _after_ calling copy_thread_tls() before commit
   4d6501dce079.

Fixes: 4d6501dce079c1eb6bf0b1d8f528a5e81770109e ("kthread: Fix use-after-free if kthread fork fails")
Reported-by: Guenter Roeck <[email protected]>
Tested-by: Guenter Roeck <[email protected]> # MIPS only
Acked-by: Stafford Horne <[email protected]>
Acked-by: Oleg Nesterov <[email protected]>
Cc: Ralf Baechle <[email protected]>
Cc: [email protected]
Cc: Jonas Bonn <[email protected]>
Cc: Stefan Kristiansson <[email protected]>
Cc: [email protected]
Cc: Jamie Iles <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Signed-off-by: Vegard Nossum <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08
Parents: 5ed02dbb

Changes

2 files changed · +0 −3

File	Status	Add	Del	Content
arch/mips/kernel/process.c	modified	+0	−1	View file
arch/openrisc/kernel/process.c	modified	+0	−2	View file

arch/mips/kernel/process.c

View file

diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 918d4c7..5351e1f 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -120,7 +120,6 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long usp,
 	struct thread_info *ti = task_thread_info(p);
 	struct pt_regs *childregs, *regs = current_pt_regs();
 	unsigned long childksp;
-	p->set_child_tid = p->clear_child_tid = NULL;
 
 	childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
 

arch/openrisc/kernel/process.c

View file

diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
index f8da545..106859a 100644
--- a/arch/openrisc/kernel/process.c
+++ b/arch/openrisc/kernel/process.c
@@ -167,8 +167,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
 
 	top_of_kernel_stack = sp;
 
-	p->set_child_tid = p->clear_child_tid = NULL;
-
 	/* Locate userspace context on stack... */
 	sp -= STACK_FRAME_OVERHEAD;	/* redzone */
 	sp -= sizeof(struct pt_regs);