Etienne Perot 8e35992021 cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children ... Since commit b69bb476de ("cgroup: fix race between fork and cgroup.kill"), the fork path snapshots the kill_seq of the child's future cgroup into kargs->kill_seq, and cgroup_post_fork() SIGKILLs the child if that cgroup's kill_seq has changed in the meantime, to catch forks racing with a cgroup.kill sweep. For CLONE_INTO_CGROUP, however, the snapshot in cgroup_css_set_fork() is taken before the target cgroup has been resolved: kargs->cgrp is always NULL at this point (it is only set at the end of the function). So the "if (kargs->cgrp)" branch is dead code and the snapshot always records the kill_seq of the parent's cgroup. cgroup_post_fork() then compares it with the kill_seq of the target cgroup, so the child gets SIGKILLed whenever the two cgroups have been killed a different number of times. As a result, once cgroup.kill has been written to a cgroup, every child subsequently cloned into it with clone3(CLONE_INTO_CGROUP) is killed on the spot, for as long as the cgroup exists: kill_seq is not exposed to userspace and never resets. Re-snapshot kill_seq from the target cgroup once it has been resolved, and drop the dead branch at the early snapshot site. This does not reopen the race fixed by b69bb476de. For CLONE_INTO_CGROUP, everything from the snapshot to the check in cgroup_post_fork() runs with cgroup_mutex held, and kill_seq is only ever incremented under cgroup_mutex. tj: Updated the comment above kill_seq to reflect the new serialization rules as suggested by Shakeel Butt. Fixes: b69bb476de ("cgroup: fix race between fork and cgroup.kill") Cc: stable@vger.kernel.org Cc: Shakeel Butt <shakeel.butt@linux.dev> Assisted-by: LLM Signed-off-by: Etienne Perot <eperot@google.com> Signed-off-by: Tejun Heo <tj@kernel.org>		2026-08-31 06:19:38 -10:00
..
acpi	Driver core changes for 7.2-rc1	2026-06-15 12:41:17 +05:30
asm-generic	mm.git review status for mm-hotfixes-stable..mm-nonmm-stable	2026-06-21 13:20:19 -07:00
clocksource
crypto	Networking changes for 7.2.	2026-06-17 08:17:00 +01:00
cxl	cxl/region: Introduce devm_cxl_probe_mem()	2026-06-12 13:47:30 -07:00
drm	drm-next for 7.2-rc1	2026-06-17 10:21:00 +01:00
dt-bindings	Char/Misc/IIO/FPGA/GPIB/etc driver updates for 7.2-rc1	2026-06-22 12:20:21 -07:00
hyperv	hyperv: Clean up and fix the guest ID comment in hvgdk.h	2026-05-27 15:05:26 -07:00
keys	keys: Pin request_key_auth payload in instantiate paths	2026-06-15 15:19:13 +03:00
kunit	linux_kselftest-kunit-7.2-rc1	2026-06-16 16:33:57 +05:30
kvm	Merge branch kvm-arm64/vgic-v5-PPI-fixes into kvmarm-master/next	2026-06-12 09:08:31 +01:00
linux	cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children	2026-08-31 06:19:38 -10:00
math-emu
media	media: v4l2-fwnode: Fix subdev owner overwritten in v4l2_async_register_subdev_sensor()	2026-06-05 10:28:03 +03:00
memory
misc
net	Asides of the avalanche of LLM-driven fixes, there are a couple of	2026-06-21 10:26:31 -07:00
pcmcia
ras
rdma	RDMA v7.2 merge window	2026-06-18 08:16:21 -07:00
rv	rv: Prevent task migration while handling per-CPU events	2026-06-03 12:33:25 +02:00
scsi
soc	phy-for-7.2	2026-06-23 15:41:48 -07:00
sound	ASoC: Updates for v7.2	2026-06-15 20:19:22 +02:00
target
trace	f2fs-for-7.2-rc1	2026-06-23 17:59:36 -07:00
uapi	Char/Misc/IIO/FPGA/GPIB/etc driver updates for 7.2-rc1	2026-06-22 12:20:21 -07:00
ufs	Merge branch 7.1/scsi-fixes into 7.2/scsi-staging	2026-06-15 21:01:30 -04:00
vdso	futex: Provide infrastructure to plug the non contended robust futex unlock race	2026-06-03 11:38:52 +02:00
video
xen	xen: constify xsd_errors array	2026-06-08 09:00:06 +02:00
Kbuild