Re: [patch V2 1/8] signal: Prevent exec() race

[Thomas Gleixner]

On Wed, Sep 09 2026 at 14:51, Peter Zijlstra wrote:
> On Wed, Sep 09, 2026 at 02:45:55PM +0200, Peter Zijlstra wrote:
>> On Wed, Sep 09, 2026 at 02:13:11PM +0200, Frederic Weisbecker wrote:
>> > P2(int *next, int *prev, int *pid, spinlock_t *sighand)
>> > {
>> > 	int r0;
>> > 	int r1;
>> > 	// get target
>> > 	r0 = READ_ONCE(*pid);
>> > 	spin_lock(sighand);
>
> There is no dependency between r0 and sighand. While I think there is in
> posixtimer_send_sigqueue(). Does making it smp_load_acquire() help?

sighand is r0->sighand->siglock and obviously not known before r0 is
read. So yes there is a data dependency in reality :)

>> > 	// queue signal
>> > 	r1 = READ_ONCE(*next);
>> > 	if (r1 == 0)
>> > 		WRITE_ONCE(*prev, 2);
>> > 	spin_unlock(sighand);
>> > }
>> > 
>> > exists (prev=1 /\ 2:r0=1) (* Bad outcome. *)