[PATCH] fix de_thread vs it_real_fn() deadlock

[Oleg Nesterov <oleg@tv-sign.ru>]

de_thread() calls del_timer_sync(->real_timer) under
->sighand->siglock. This is deadlockable, it_real_fn
sends a signal and needs this lock too.

Also, delete unneeded ->real_timer.data assignment.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>

--- 2.6.14-rc2/fs/exec.c~3_DEIT	2005-09-21 21:08:33.000000000 +0400
+++ 2.6.14-rc2/fs/exec.c	2005-09-24 20:31:25.000000000 +0400
@@ -646,8 +646,10 @@ static inline int de_thread(struct task_
 		 * before we can safely let the old group leader die.
 		 */
 		sig->real_timer.data = (unsigned long)current;
+		spin_unlock_irq(lock);
 		if (del_timer_sync(&sig->real_timer))
 			add_timer(&sig->real_timer);
+		spin_lock_irq(lock);
 	}
 	while (atomic_read(&sig->count) > count) {
 		sig->group_exit_task = current;
@@ -659,7 +661,6 @@ static inline int de_thread(struct task_
 	}
 	sig->group_exit_task = NULL;
 	sig->notify_count = 0;
-	sig->real_timer.data = (unsigned long)current;
 	spin_unlock_irq(lock);
 
 	/*
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/