On Thu, 10 Jul 2008, Roland McGrath wrote:
quoted text
> 
> There are many different scenarios that could hit this bug, most of
> them races.  The simplest one to demonstrate does not require any
> race: when one signal has done handler setup at the check before
> returning from a syscall, and there is another signal pending that
> should be handled.  The second signal's handler should interrupt the
> first signal handler before it actually starts (so the interrupted PC
> is still at the handler's entry point).  Instead, it runs away until
> the next kernel entry (next syscall, tick, etc).

I have this dim memory of at least _some_ of this being on purpose.

If you look at old kernels (_really_ old ones - I think it's way before 
even the historical git archive, but I didn't take a look), we used to set 
up several stack frames at once, so that we'd nest the stack frames 
completely.

In other words, the code in do_signal() used to literally be a loop, 
something like

	while ((signr = get_signal_to_deliver(&info, &ka, regs, NULL)) > 0) {
		.. setup signal frame ..

(No, I don't think that's at all accurate of the actual code we used to 
have - I just took the current do_signal() code as an example)

And that explicit loop was removed in order for us to have just a single 
outstanding signal at a time. I forget the exact details why.

But if you really want that behaviour, then re-introducing the loop would 
likely be the better approach (or should be combined), since I think you 
effectively just re-introduced it (at a much bigger granularity).

Hmm.

		Linus
--
unsubscribe notice
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/