7.3-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 5f4a3f743acc96987ae5c2e966947942c34ba56c ] Since commit da13e0e72a73 ("cgroup: fix cgroup.kill for exited thread group leader"), __cgroup_kill() visits every thread in the cgroup and sends SIGKILL with PIDTYPE_TGID, so each visited thread takes down its whole thread group. A thread that has started exiting can stay in a cgroup after its process has been moved out of it. cgroup_migrate_add_task() skips PF_EXITING tasks, and the thread is only unlinked by cgroup_task_dead() after its final context switch. mm_release() clears the thread's clear_child_tid word and wakes the joiner well before that, so pthread_join() can return while the thread is still in the old cgroup. If cgroup.kill is written in that window, __cgroup_kill() finds the exiting thread and complete_signal() passes the group-wide SIGKILL on to a live thread, killing a process that already left the cgroup. The cgroup selftest test_stress.sh runs into this: test_cgcore_proc_migration() joins its threads, moves itself back to the root cgroup, and cg_destroy() falls back to cgroup.kill on the old cgroup when rmdir() fails with EBUSY, so test_core kills itself. KernelCI has been reporting "with_stress.sh: line 94: ... Killed" on several arm64 boards since the commit reached linux-next. Keep visiting every thread, but go back to sending SIGKILL to the thread that was found. A SIGKILL sent to a live thread still kills its whole thread group, so both cases fixed by that commit stay fixed, and task_can_queue_signal() drops one sent to a thread that is already exiting. Fixes: da13e0e72a73 ("cgroup: fix cgroup.kill for exited thread group leader") Cc: stable@vger.kernel.org # v5.14+ Link: https://lore.kernel.org/all/179272264722.329188.4773475583351189022@6e52bff8000c/ Signed-off-by: Sasha Levin Signed-off-by: Tejun Heo Signed-off-by: Sasha Levin --- kernel/cgroup/cgroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index a1cc11009e49e..2d582603a7114 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -4299,7 +4299,7 @@ static void __cgroup_kill(struct cgroup *cgrp) if (__fatal_signal_pending(task)) continue; - do_send_sig_info(SIGKILL, SEND_SIG_NOINFO, task, PIDTYPE_TGID); + send_sig(SIGKILL, task, 0); } css_task_iter_end(&it); } -- 2.53.0