Re: [PATCH] exit: fix lost-update race on the child_subreaper bitfields

[Nickolai Zeldovich]

On Sun, Oct 11, 2026 at 8:09 AM Oleg Nesterov <oleg@xxxxxxxxxx> wrote:
> On 10/09, Nickolai Zeldovich wrote:
> ...
> > but it shares the word and is converted with the other two.
>
> So why? If you turn the *_child_subreaper members to bool, then
> autoreap:1 is fine?

You're right, autoreap can stay a bitfield.  (I somehow missed the
fact that there's one more bitfield below under CONFIG_POSIX_TIMERS.)
With autoreap as a bitfield, it can then share memory with
timer_create_restore_ids:1 (CONFIG_POSIX_TIMERS=y), and that pair is
race-free: autoreap is stored exactly once, in copy_process() before
the new signal_struct is reachable by anyone, and
timer_create_restore_ids is only stored to current->signal (prctl) or
tsk->signal on exec, i.e. never to a struct that can still receive the
autoreap store.

Will send the v2 patch shortly.

Thanks,

Nickolai.