Merge tag 'pinctrl-v3.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw...

[cascardo/linux.git] / kernel / signal.c

diff --git a/kernel/signal.c b/kernel/signal.c
index 8f0876f..16a3052 100644 (file)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1275,7 +1275,17 @@ struct sighand_struct *__lock_task_sighand(struct task_struct *tsk,
                        local_irq_restore(*flags);
                        break;
                }
-
+               /*
+                * This sighand can be already freed and even reused, but
+                * we rely on SLAB_DESTROY_BY_RCU and sighand_ctor() which
+                * initializes ->siglock: this slab can't go away, it has
+                * the same object type, ->siglock can't be reinitialized.
+                *
+                * We need to ensure that tsk->sighand is still the same
+                * after we take the lock, we can race with de_thread() or
+                * __exit_signal(). In the latter case the next iteration
+                * must see ->sighand == NULL.
+                */
                spin_lock(&sighand->siglock);
                if (likely(sighand == tsk->sighand)) {
                        rcu_read_unlock();
@@ -1331,23 +1341,21 @@ int kill_pid_info(int sig, struct siginfo *info, struct pid *pid)
        int error = -ESRCH;
        struct task_struct *p;
 
-       rcu_read_lock();
-retry:
-       p = pid_task(pid, PIDTYPE_PID);
-       if (p) {
-               error = group_send_sig_info(sig, info, p);
-               if (unlikely(error == -ESRCH))
-                       /*
-                        * The task was unhashed in between, try again.
-                        * If it is dead, pid_task() will return NULL,
-                        * if we race with de_thread() it will find the
-                        * new leader.
-                        */
-                       goto retry;
-       }
-       rcu_read_unlock();
+       for (;;) {
+               rcu_read_lock();
+               p = pid_task(pid, PIDTYPE_PID);
+               if (p)
+                       error = group_send_sig_info(sig, info, p);
+               rcu_read_unlock();
+               if (likely(!p || error != -ESRCH))
+                       return error;
 
-       return error;
+               /*
+                * The task was unhashed in between, try again.  If it
+                * is dead, pid_task() will return NULL, if we race with
+                * de_thread() it will find the new leader.
+                */
+       }
 }
 
 int kill_proc_info(int sig, struct siginfo *info, pid_t pid)
@@ -2747,6 +2755,10 @@ int copy_siginfo_to_user(siginfo_t __user *to, const siginfo_t *from)
                 */
                if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)
                        err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb);
+#endif
+#ifdef SEGV_BNDERR
+               err |= __put_user(from->si_lower, &to->si_lower);
+               err |= __put_user(from->si_upper, &to->si_upper);
 #endif
                break;
        case __SI_CHLD: