From nobody Mon Aug 24 04:17:45 2026 Received: from mail-oi1-f199.google.com (mail-oi1-f199.google.com [209.85.167.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 63079346E75 for ; Sun, 16 Aug 2026 16:12:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786896744; cv=none; b=JVuXtW2o89ZprLDVSQ/l/0MbBQLRlMpxhyzA2Mkcp3Bgn2aIkglGEOCAvRww4pl0Up7jY/SksdLYgv6z53TYJhDZAsYkUrUDi4CbCgY4m5ttlxMwuisYW4Wd23Dm09j9N65lyJSqvRdSTsq/XbIifgNBiG27/f0Axqht3nIvY+o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786896744; c=relaxed/simple; bh=/WP+AvHfC0Pb7FDW5nuaCkpoSjTZa9kcJOCR0DXz1dU=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=kZkg3FUaQhuqMMLPRo1tyDOpD/LXw0r594eVAn76UTZf42XDeWUE3xQSHWaGODm0gR8eG+Qw9IHCXE50C014ab2K1Cx+LmwMaCNmqHCJTkhWllMJOeZCdHtbSdAOKZpVfda/CMPaINgf9NxT4vP+/KEI3jhUbcYdjsvyA0LqoOo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--avagin.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bsxXh/Qk; arc=none smtp.client-ip=209.85.167.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--avagin.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bsxXh/Qk" Received: by mail-oi1-f199.google.com with SMTP id 5614622812f47-4ab4dd46ddeso1544995b6e.3 for ; Sun, 16 Aug 2026 09:12:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786896742; x=1787501542; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=TaYKViIByQqModasEXNrzI0T6qlVRXyx9KZe5Fm4+mg=; b=bsxXh/QkPxKUyzy2rwCPRcgGcIOAMOPUx5V1SaFev7x2J8mVPwt5POy54QaXBPBL83 ANTTc2umFzUXwQ4SYQAPthgZZ8cDzgCi+YUJiwRDPKZ7SAjDyFdur/QyjRngGIwFE8Nq BBLvk9TeXLksP7SLKcoSdfxflYSO0OhqLQUDd56ig6bHkGTn8BrfZ0PVT5ORYol5LkVf 2kKD9SRO2ZTAG5dqiGMOrgGNE9jjdXMwDlDpvnNamUZJ5mMvg45fnmTUaJjfvLgkHakt 0Fy4tGZI5RJVo2rcctHdU2mDuIw4iOu5DbU6I8iflvi5wcxphQvOwt5BLvt0L+ocH3nv 954g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786896742; x=1787501542; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=TaYKViIByQqModasEXNrzI0T6qlVRXyx9KZe5Fm4+mg=; b=X3aC4iqmoEw3t3m/kpNmOkwLkuNOqGfx/GtrwChA1Ux/8uqltmlmzRX4NCD1RkKiCU ktEqL8zZoPI1EkRnpwEQSiN6r62/UDLOJ+2+tWAMsCy5q4bQCL6iKZRIPrH84izKAzWt NgVgm2qQKfHrQG+vNYkpBNt3yXYN/w8uEkN1mQlSK/73P6VlwYLcnM4p92NaWZr2yvUG 956IkEP5aAW9N6uzLaTXBP+1W+28sPPZONenWGjBAbQxSBtRb8QvTwXLbZIfG86iTVwz QlfDH5nqtcJuNm0tK5Vz26WzLGF6hkGx6TgVDoUggjHQZraCDlg/22rTCu9rHmbyQh6d Gp9Q== X-Gm-Message-State: AOJu0Yy6jg3Rer4OTzb/w330vKEBhQpA3xwJ3As1+jhEo7HP26wd7B2z ZVyP3APcYZCbB8IayK67dzZN08VZmfvdmIT3khFwX1GBHK9CTj3xcgAgB1x4++fctNk9L5Sxgs1 InasfJA== X-Received: from iobdj25.prod.google.com ([2002:a05:6602:2579:b0:9ab:7c1:c30a]) (user=avagin job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6820:6aea:b0:6ae:ab01:91a3 with SMTP id 006d021491bc7-6b0d68f9c98mr16927443eaf.35.1786896741883; Sun, 16 Aug 2026 09:12:21 -0700 (PDT) Date: Sun, 16 Aug 2026 16:12:15 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260816161216.984580-1-avagin@google.com> Subject: [PATCH] proc: Report SIGEV_NONE in /proc/pid/timers if target task has died From: Andrei Vagin To: Thomas Gleixner , Andrew Morton Cc: linux-kernel@vger.kernel.org, criu@lists.linux.dev, Andrei Vagin , Thomas Gleixner Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When a posix timer is created targeting a specific thread (using SIGEV_SIGNAL | SIGEV_THREAD_ID), it takes a reference to the target struct pid in timer->it_pid. If the target thread subsequently terminates, its numeric tid is freed and can be recycled for an unrelated task. However, the timer holds its reference to the original struct pid. show_timer() in /proc/[pid]/timers previously called pid_nr_ns() directly on timer->it_pid without checking whether any task remained attached to that struct pid. As a result: 1. It reported the stale tid, which could mistakenly refer to a recycled pid. 2. In the kernel, expired signals for dead target threads are dropped by posixtimer_send_sigqueue() because posixtimer_get_target() returns NULL, so the timer functionally acts as SIGEV_NONE. 3. Checkpoint/restore tools (CRIU) parsing /proc/[pid]/timers would try to restore a timer with SIGEV_SIGNAL | SIGEV_THREAD_ID targeting a non-existent or unrelated thread. Check pid_has_task(timer->it_pid, timer->it_pid_type) in show_timer(). If the target task has died, override notify to SIGEV_NONE and report PID 0 (e.g., 'notify: none/pid.0'). Cc: Thomas Gleixner Signed-off-by: Andrei Vagin Reviewed-by: Pavel Tikhomirov --- fs/proc/base.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 780f81259052..e3a6ea4fffea 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2519,17 +2519,23 @@ static int show_timer(struct seq_file *m, void *v) struct k_itimer *timer =3D hlist_entry((struct hlist_node *)v, struct k_i= timer, list); struct timers_private *tp =3D m->private; int notify =3D timer->it_sigev_notify; + pid_t nr =3D 0; =20 guard(spinlock_irq)(&timer->it_lock); if (!posixtimer_valid(timer)) return 0; =20 + if (timer->it_pid && pid_has_task(timer->it_pid, timer->it_pid_type)) + nr =3D pid_nr_ns(timer->it_pid, tp->ns); + else + notify =3D SIGEV_NONE; + seq_printf(m, "ID: %d\n", timer->it_id); seq_printf(m, "signal: %d/%px\n", timer->sigq.info.si_signo, timer->sigq.info.si_value.sival_ptr); seq_printf(m, "notify: %s/%s.%d\n", nstr[notify & ~SIGEV_THREAD_ID], (notify & SIGEV_THREAD_ID) ? "tid" : "pid", - pid_nr_ns(timer->it_pid, tp->ns)); + nr); seq_printf(m, "ClockID: %d\n", timer->it_clock); =20 return 0; --=20 2.55.0.691.gc56d675ccc-goog