Merge patch series "coredump & signals: an impossible affair"

Christian Brauner <brauner@kernel.org> says:

I asked Chris to look at the coredump code with kres and it found a few
bugs. I started looking as well and found a few more. Here's a fixes
series. I also used TLA+ modeling for this.

- UAF in coredump_finish(): a parked thread can be freed before it is
  woken
- only SIGKILL and the freezers interrupt a dump now, cgroup v2 included
- the io-wq exit bit wasn't ordered against worker creation task work,
  exit could hang on worker_done
- shared signals are no longer retargeted to the dumper, that truncated
  cores
- an io-wq worker of an SQPOLL ring as the dumper deadlocks the group,
  user workers never dump now
- PTRACE_SETSIGMASK can't unmask a user worker anymore, the only way in
- exec cancels io_uring before de_thread(), nothing adds a thread after
  it
- no io threads from PF_SIGNALED or PF_POSTCOREDUMP creators, they
  broke threads_remaining

* patches from https://patch.msgid.link/20260921-work-coredump-fixes-v3-0-8e4adb1619e6@kernel.org:
  signal: enforce the user worker signal mask in __set_task_blocked()
  fork: use SIG_KERNEL_ONLY_MASK for the user worker signal mask
  fork: don't create io threads once PF_POSTCOREDUMP is set
  fork: move the coredump and exec checks into create_io_thread()
  exec: cancel io_uring requests before de_thread()
  selftests/coredump: expect PTRACE_SETSIGMASK to be refused on a user worker
  selftests/coredump: test a user worker as the coredumping thread
  ptrace: refuse to change the signal mask of a user worker
  selftests/coredump: test shared signal retargeting during a dump
  signal: don't retarget shared signals in a dying thread group
  io-wq: order the exit bit against worker creation task work
  signal: only SIGKILL and the freezers interrupt a coredumping task
  coredump: hold RCU while releasing parked threads

Link: https://patch.msgid.link/20260921-work-coredump-fixes-v3-0-8e4adb1619e6@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

0 files changed, 0 insertions, 0 deletions