From: Oleg Nesterov This patch pidhash-kill-switch_exec_pids.patch changed de_thread() so that it doesn't remove 'leader' from it's thread group. However de_thread() still adds current to init_task.tasks without removing 'leader' from this list. What if another CLONE_VM task starts do_coredump() after de_thread() drops tasklist_lock but before it calls release_task(leader) ? do_coredump()->zap_threads() will find this thread group twice on init_task.tasks list. And it will increment mm->core_waiters twice for the new leader (current in de_thread). So, exit_mm()->complete(mm->core_startup_done) doesn't happen, and we have a deadlock. Signed-off-by: Oleg Nesterov Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton --- fs/exec.c | 2 +- kernel/exit.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff -puN fs/exec.c~task-make-task-list-manipulations-rcu-safe-fix fs/exec.c --- 25/fs/exec.c~task-make-task-list-manipulations-rcu-safe-fix Thu Apr 6 16:40:43 2006 +++ 25-akpm/fs/exec.c Thu Apr 6 16:40:43 2006 @@ -718,7 +718,7 @@ static int de_thread(struct task_struct attach_pid(current, PIDTYPE_PID, current->pid); attach_pid(current, PIDTYPE_PGID, current->signal->pgrp); attach_pid(current, PIDTYPE_SID, current->signal->session); - list_add_tail_rcu(¤t->tasks, &init_task.tasks); + list_replace_rcu(&leader->tasks, ¤t->tasks); current->parent = current->real_parent = leader->real_parent; leader->parent = leader->real_parent = child_reaper; diff -puN kernel/exit.c~task-make-task-list-manipulations-rcu-safe-fix kernel/exit.c --- 25/kernel/exit.c~task-make-task-list-manipulations-rcu-safe-fix Thu Apr 6 16:40:43 2006 +++ 25-akpm/kernel/exit.c Thu Apr 6 16:40:43 2006 @@ -55,7 +55,9 @@ static void __unhash_process(struct task detach_pid(p, PIDTYPE_PGID); detach_pid(p, PIDTYPE_SID); - list_del_rcu(&p->tasks); + /* see de_thread()->list_replace_rcu() */ + if (likely(p->tasks.prev != LIST_POISON2)) + list_del_rcu(&p->tasks); __get_cpu_var(process_counts)--; } list_del_rcu(&p->thread_group); _