posix timers: sigqueue_free: don't free sigqueue if it is queued

Currently sigqueue_free() removes sigqueue from list, but doesn't cancel the
pending signal. This is not consistent, the task should either receive the
"full" signal along with siginfo_t, or it shouldn't receive the signal at all.

Change sigqueue_free() to clear SIGQUEUE_PREALLOC but leave sigqueue on list
if it is queued.

This is a user-visible change. If the signal is blocked, it stays queued
after sys_timer_delete() until unblocked with the "stale" si_code/si_value,
and of course it is still counted wrt RLIMIT_SIGPENDING which also limits
the number of posix timers.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Austin Clements <amdragon+kernelbugzilla@mit.edu>
Cc: Roland McGrath <roland@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/kernel/signal.c b/kernel/signal.c
index 12ffea7c201dd4a027eb403651e3563716756ab2..2955f6c4f36eceb991f209cc4d351d6e0c176937 100644 (file)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1240,18 +1240,22 @@ void sigqueue_free(struct sigqueue *q)
 
        BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
        /*
-        * If the signal is still pending remove it from the
-        * pending queue. We must hold ->siglock while testing
-        * q->list to serialize with collect_signal() or with
+        * We must hold ->siglock while testing q->list
+        * to serialize with collect_signal() or with
         * __exit_signal()->flush_sigqueue().
         */
        spin_lock_irqsave(lock, flags);
+       q->flags &= ~SIGQUEUE_PREALLOC;
+       /*
+        * If it is queued it will be freed when dequeued,
+        * like the "regular" sigqueue.
+        */
        if (!list_empty(&q->list))
-               list_del_init(&q->list);
+               q = NULL;
        spin_unlock_irqrestore(lock, flags);
 
-       q->flags &= ~SIGQUEUE_PREALLOC;
-       __sigqueue_free(q);
+       if (q)
+               __sigqueue_free(q);
 }
 
 int send_sigqueue(struct sigqueue *q, struct task_struct *t, int group)