Commit 0d8f2274 authored by Vegard Nossum's avatar Vegard Nossum Committed by Greg Kroah-Hartman

kthread: fix boot hang (regression) on MIPS/OpenRISC

commit b0f5a8f3 upstream.

This fixes a regression in commit 4d6501dc where I didn't notice
that MIPS and OpenRISC were reinitialising p->{set,clear}_child_tid to
NULL after our initialisation in copy_process().

We can simply get rid of the arch-specific initialisation here since it
is now always done in copy_process() before hitting copy_thread{,_tls}().

Review notes:

 - As far as I can tell, copy_process() is the only user of
   copy_thread_tls(), which is the only caller of copy_thread() for
   architectures that don't implement copy_thread_tls().

 - After this patch, there is no arch-specific code touching
   p->set_child_tid or p->clear_child_tid whatsoever.

 - It may look like MIPS/OpenRISC wanted to always have these fields be
   NULL, but that's not true, as copy_process() would unconditionally
   set them again _after_ calling copy_thread_tls() before commit

Fixes: 4d6501dc ("kthread: Fix use-after-free if kthread fork fails")
Reported-by: default avatarGuenter Roeck <>
Tested-by: Guenter Roeck <> # MIPS only
Acked-by: default avatarStafford Horne <>
Acked-by: default avatarOleg Nesterov <>
Cc: Ralf Baechle <>
Cc: Jonas Bonn <>
Cc: Stefan Kristiansson <>
Cc: Jamie Iles <>
Cc: Thomas Gleixner <>
Signed-off-by: default avatarVegard Nossum <>
Signed-off-by: default avatarLinus Torvalds <>
Signed-off-by: default avatarAmit Pundir <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent a70e46bc
......@@ -118,7 +118,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
struct thread_info *ti = task_thread_info(p);
struct pt_regs *childregs, *regs = current_pt_regs();
unsigned long childksp;
p->set_child_tid = p->clear_child_tid = NULL;
childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
......@@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
top_of_kernel_stack = sp;
p->set_child_tid = p->clear_child_tid = NULL;
/* Locate userspace context on stack... */
sp -= STACK_FRAME_OVERHEAD; /* redzone */
sp -= sizeof(struct pt_regs);
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment