This commit was manufactured by cvs2svn to create branch 'vserver'.
[linux-2.6.git] / kernel / signal.c
index 4d39765..83cd433 100644 (file)
 #include <linux/tty.h>
 #include <linux/binfmts.h>
 #include <linux/security.h>
+#include <linux/syscalls.h>
 #include <linux/ptrace.h>
+#include <linux/posix-timers.h>
+#include <linux/signal.h>
+#include <linux/audit.h>
+#include <linux/capability.h>
+#include <linux/vs_cvirt.h>
 #include <asm/param.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 #include <asm/siginfo.h>
 
-extern void k_getrusage(struct task_struct *, int, struct rusage *);
-
 /*
  * SLAB caches for signal bits.
  */
@@ -152,11 +156,6 @@ static kmem_cache_t *sigqueue_cachep;
        (!T(signr, SIG_KERNEL_IGNORE_MASK|SIG_KERNEL_STOP_MASK) && \
         (t)->sighand->action[(signr)-1].sa.sa_handler == SIG_DFL)
 
-#define sig_avoid_stop_race() \
-       (sigtestsetmask(&current->pending.signal, M(SIGCONT) | M(SIGKILL)) || \
-        sigtestsetmask(&current->signal->shared_pending.signal, \
-                                                 M(SIGCONT) | M(SIGKILL)))
-
 static int sig_ignored(struct task_struct *t, int sig)
 {
        void __user * handler;
@@ -216,6 +215,7 @@ static inline int has_pending_signals(sigset_t *signal, sigset_t *blocked)
 fastcall void recalc_sigpending_tsk(struct task_struct *t)
 {
        if (t->signal->group_stop_count > 0 ||
+           (freezing(t)) ||
            PENDING(&t->pending, &t->blocked) ||
            PENDING(&t->signal->shared_pending, &t->blocked))
                set_tsk_thread_flag(t, TIF_SIGPENDING);
@@ -264,24 +264,27 @@ next_signal(struct sigpending *pending, sigset_t *mask)
        return sig;
 }
 
-static struct sigqueue *__sigqueue_alloc(void)
+static struct sigqueue *__sigqueue_alloc(struct task_struct *t, gfp_t flags,
+                                        int override_rlimit)
 {
        struct sigqueue *q = NULL;
 
-       if (atomic_read(&current->user->sigpending) <
-                       current->rlim[RLIMIT_SIGPENDING].rlim_cur)
-               q = kmem_cache_alloc(sigqueue_cachep, GFP_ATOMIC);
-       if (q) {
+       atomic_inc(&t->user->sigpending);
+       if (override_rlimit ||
+           atomic_read(&t->user->sigpending) <=
+                       t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
+               q = kmem_cache_alloc(sigqueue_cachep, flags);
+       if (unlikely(q == NULL)) {
+               atomic_dec(&t->user->sigpending);
+       } else {
                INIT_LIST_HEAD(&q->list);
                q->flags = 0;
-               q->lock = NULL;
-               q->user = get_uid(current->user);
-               atomic_inc(&q->user->sigpending);
+               q->user = get_uid(t->user);
        }
        return(q);
 }
 
-static inline void __sigqueue_free(struct sigqueue *q)
+static void __sigqueue_free(struct sigqueue *q)
 {
        if (q->flags & SIGQUEUE_PREALLOC)
                return;
@@ -328,13 +331,20 @@ void __exit_sighand(struct task_struct *tsk)
        /* Ok, we're done with the signal handlers */
        tsk->sighand = NULL;
        if (atomic_dec_and_test(&sighand->count))
-               kmem_cache_free(sighand_cachep, sighand);
+               sighand_free(sighand);
 }
 
 void exit_sighand(struct task_struct *tsk)
 {
        write_lock_irq(&tasklist_lock);
-       __exit_sighand(tsk);
+       rcu_read_lock();
+       if (tsk->sighand != NULL) {
+               struct sighand_struct *sighand = rcu_dereference(tsk->sighand);
+               spin_lock(&sighand->siglock);
+               __exit_sighand(tsk);
+               spin_unlock(&sighand->siglock);
+       }
+       rcu_read_unlock();
        write_unlock_irq(&tasklist_lock);
 }
 
@@ -344,17 +354,20 @@ void exit_sighand(struct task_struct *tsk)
 void __exit_signal(struct task_struct *tsk)
 {
        struct signal_struct * sig = tsk->signal;
-       struct sighand_struct * sighand = tsk->sighand;
+       struct sighand_struct * sighand;
 
        if (!sig)
                BUG();
        if (!atomic_read(&sig->count))
                BUG();
+       rcu_read_lock();
+       sighand = rcu_dereference(tsk->sighand);
        spin_lock(&sighand->siglock);
+       posix_cpu_timers_exit(tsk);
        if (atomic_dec_and_test(&sig->count)) {
-               if (tsk == sig->curr_target)
-                       sig->curr_target = next_thread(tsk);
+               posix_cpu_timers_exit_group(tsk);
                tsk->signal = NULL;
+               __exit_sighand(tsk);
                spin_unlock(&sighand->siglock);
                flush_sigqueue(&sig->shared_pending);
        } else {
@@ -379,39 +392,33 @@ void __exit_signal(struct task_struct *tsk)
                 * We won't ever get here for the group leader, since it
                 * will have been the last reference on the signal_struct.
                 */
-               sig->utime += tsk->utime;
-               sig->stime += tsk->stime;
+               sig->utime = cputime_add(sig->utime, tsk->utime);
+               sig->stime = cputime_add(sig->stime, tsk->stime);
                sig->min_flt += tsk->min_flt;
                sig->maj_flt += tsk->maj_flt;
                sig->nvcsw += tsk->nvcsw;
                sig->nivcsw += tsk->nivcsw;
+               sig->sched_time += tsk->sched_time;
+               __exit_sighand(tsk);
                spin_unlock(&sighand->siglock);
                sig = NULL;     /* Marker for below.  */
        }
+       rcu_read_unlock();
        clear_tsk_thread_flag(tsk,TIF_SIGPENDING);
        flush_sigqueue(&tsk->pending);
        if (sig) {
                /*
-                * We are cleaning up the signal_struct here.  We delayed
-                * calling exit_itimers until after flush_sigqueue, just in
-                * case our thread-local pending queue contained a queued
-                * timer signal that would have been cleared in
-                * exit_itimers.  When that called sigqueue_free, it would
-                * attempt to re-take the tasklist_lock and deadlock.  This
-                * can never happen if we ensure that all queues the
-                * timer's signal might be queued on have been flushed
-                * first.  The shared_pending queue, and our own pending
-                * queue are the only queues the timer could be on, since
-                * there are no other threads left in the group and timer
-                * signals are constrained to threads inside the group.
+                * We are cleaning up the signal_struct here.
                 */
-               exit_itimers(sig);
+               exit_thread_group_keys(sig);
                kmem_cache_free(signal_cachep, sig);
        }
 }
 
 void exit_signal(struct task_struct *tsk)
 {
+       atomic_dec(&tsk->signal->live);
+
        write_lock_irq(&tasklist_lock);
        __exit_signal(tsk);
        write_unlock_irq(&tasklist_lock);
@@ -470,7 +477,7 @@ unblock_all_signals(void)
        spin_unlock_irqrestore(&current->sighand->siglock, flags);
 }
 
-static inline int collect_signal(int sig, struct sigpending *list, siginfo_t *info)
+static int collect_signal(int sig, struct sigpending *list, siginfo_t *info)
 {
        struct sigqueue *q, *first = NULL;
        int still_pending = 0;
@@ -550,10 +557,34 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
        if (!signr)
                signr = __dequeue_signal(&tsk->signal->shared_pending,
                                         mask, info);
+       if (signr && unlikely(sig_kernel_stop(signr))) {
+               /*
+                * Set a marker that we have dequeued a stop signal.  Our
+                * caller might release the siglock and then the pending
+                * stop signal it is about to process is no longer in the
+                * pending bitmasks, but must still be cleared by a SIGCONT
+                * (and overruled by a SIGKILL).  So those cases clear this
+                * shared flag after we've set it.  Note that this flag may
+                * remain set after the signal we return is ignored or
+                * handled.  That doesn't matter because its only purpose
+                * is to alert stop-signal processing code when another
+                * processor has come along and cleared the flag.
+                */
+               if (!(tsk->signal->flags & SIGNAL_GROUP_EXIT))
+                       tsk->signal->flags |= SIGNAL_STOP_DEQUEUED;
+       }
        if ( signr &&
             ((info->si_code & __SI_MASK) == __SI_TIMER) &&
             info->si_sys_private){
+               /*
+                * Release the siglock to ensure proper locking order
+                * of timer locks outside of siglocks.  Note, we leave
+                * irqs disabled here, since the posix-timers code is
+                * about to disable them again anyway.
+                */
+               spin_unlock(&tsk->sighand->siglock);
                do_schedule_next_timer(info);
+               spin_lock(&tsk->sighand->siglock);
        }
        return signr;
 }
@@ -576,19 +607,46 @@ void signal_wake_up(struct task_struct *t, int resume)
        set_tsk_thread_flag(t, TIF_SIGPENDING);
 
        /*
-        * If resume is set, we want to wake it up in the TASK_STOPPED case.
-        * We don't check for TASK_STOPPED because there is a race with it
+        * For SIGKILL, we want to wake it up in the stopped/traced case.
+        * We don't check t->state here because there is a race with it
         * executing another processor and just now entering stopped state.
-        * By calling wake_up_process any time resume is set, we ensure
-        * the process will wake up and handle its stop or death signal.
+        * By using wake_up_state, we ensure the process will wake up and
+        * handle its death signal.
         */
        mask = TASK_INTERRUPTIBLE;
        if (resume)
-               mask |= TASK_STOPPED;
+               mask |= TASK_STOPPED | TASK_TRACED;
        if (!wake_up_state(t, mask))
                kick_process(t);
 }
 
+/*
+ * Remove signals in mask from the pending set and queue.
+ * Returns 1 if any signals were found.
+ *
+ * All callers must be holding the siglock.
+ *
+ * This version takes a sigset mask and looks at all signals,
+ * not just those in the first mask word.
+ */
+static int rm_from_queue_full(sigset_t *mask, struct sigpending *s)
+{
+       struct sigqueue *q, *n;
+       sigset_t m;
+
+       sigandsets(&m, mask, &s->signal);
+       if (sigisemptyset(&m))
+               return 0;
+
+       signandsets(&s->signal, &s->signal, mask);
+       list_for_each_entry_safe(q, n, &s->list, list) {
+               if (sigismember(mask, q->info.si_signo)) {
+                       list_del_init(&q->list);
+                       __sigqueue_free(q);
+               }
+       }
+       return 1;
+}
 /*
  * Remove signals in mask from the pending set and queue.
  * Returns 1 if any signals were found.
@@ -619,14 +677,14 @@ static int rm_from_queue(unsigned long mask, struct sigpending *s)
 static int check_kill_permission(int sig, struct siginfo *info,
                                 struct task_struct *t)
 {
-       int error = -EINVAL;
        int user;
+       int error = -EINVAL;
 
-       if (sig < 0 || sig > _NSIG)
+       if (!valid_signal(sig))
                return error;
 
-       user = (!info || ((unsigned long)info != 1 &&
-               (unsigned long)info != 2 && SI_FROMUSER(info)));
+       user = ((info == SEND_SIG_NOINFO) ||
+               (!is_si_special(info) && SI_FROMUSER(info)));
 
        error = -EPERM;
        if (user && ((sig != SIGCONT) ||
@@ -640,12 +698,15 @@ static int check_kill_permission(int sig, struct siginfo *info,
        if (user && !vx_check(vx_task_xid(t), VX_ADMIN|VX_IDENT))
                return error;
 
-       return security_task_kill(t, info, sig);
+       error = security_task_kill(t, info, sig);
+       if (!error)
+               audit_signal_info(sig, t); /* Let audit system see the signal */
+       return error;
 }
 
 /* forward decl */
 static void do_notify_parent_cldstop(struct task_struct *tsk,
-                                    struct task_struct *parent,
+                                    int to_self,
                                     int why);
 
 /*
@@ -659,6 +720,12 @@ static void handle_stop_signal(int sig, struct task_struct *p)
 {
        struct task_struct *t;
 
+       if (p->signal->flags & SIGNAL_GROUP_EXIT)
+               /*
+                * The process is in the middle of dying already.
+                */
+               return;
+
        if (sig_kernel_stop(sig)) {
                /*
                 * This is a stop signal.  Remove SIGCONT from all queues.
@@ -688,16 +755,9 @@ static void handle_stop_signal(int sig, struct task_struct *p)
                         * the SIGCHLD was pending on entry to this kill.
                         */
                        p->signal->group_stop_count = 0;
-                       p->signal->stop_state = 1;
+                       p->signal->flags = SIGNAL_STOP_CONTINUED;
                        spin_unlock(&p->sighand->siglock);
-                       if (p->ptrace & PT_PTRACED)
-                               do_notify_parent_cldstop(p, p->parent,
-                                                        CLD_STOPPED);
-                       else
-                               do_notify_parent_cldstop(
-                                       p->group_leader,
-                                       p->group_leader->real_parent,
-                                                        CLD_STOPPED);
+                       do_notify_parent_cldstop(p, (p->ptrace & PT_PTRACED), CLD_STOPPED);
                        spin_lock(&p->sighand->siglock);
                }
                rm_from_queue(SIG_KERNEL_STOP_MASK, &p->signal->shared_pending);
@@ -730,24 +790,30 @@ static void handle_stop_signal(int sig, struct task_struct *p)
                        t = next_thread(t);
                } while (t != p);
 
-               if (p->signal->stop_state > 0) {
+               if (p->signal->flags & SIGNAL_STOP_STOPPED) {
                        /*
                         * We were in fact stopped, and are now continued.
                         * Notify the parent with CLD_CONTINUED.
                         */
-                       p->signal->stop_state = -1;
+                       p->signal->flags = SIGNAL_STOP_CONTINUED;
                        p->signal->group_exit_code = 0;
                        spin_unlock(&p->sighand->siglock);
-                       if (p->ptrace & PT_PTRACED)
-                               do_notify_parent_cldstop(p, p->parent,
-                                                        CLD_CONTINUED);
-                       else
-                               do_notify_parent_cldstop(
-                                       p->group_leader,
-                                       p->group_leader->real_parent,
-                                                        CLD_CONTINUED);
+                       do_notify_parent_cldstop(p, (p->ptrace & PT_PTRACED), CLD_CONTINUED);
                        spin_lock(&p->sighand->siglock);
+               } else {
+                       /*
+                        * We are not stopped, but there could be a stop
+                        * signal in the middle of being processed after
+                        * being removed from the queue.  Clear that too.
+                        */
+                       p->signal->flags = 0;
                }
+       } else if (sig == SIGKILL) {
+               /*
+                * Make sure that any pending stop signal already dequeued
+                * is undone by the wakeup for SIGKILL.
+                */
+               p->signal->flags = 0;
        }
 }
 
@@ -761,7 +827,7 @@ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
         * fast-pathed signals for kernel-internal things like SIGSTOP
         * or SIGKILL.
         */
-       if ((unsigned long)info == 2)
+       if (info == SEND_SIG_FORCED)
                goto out_set;
 
        /* Real-time signals must be queued if sent by sigqueue, or
@@ -772,24 +838,20 @@ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
           make sure at least one signal gets delivered and don't
           pass on the info struct.  */
 
-       if (atomic_read(&t->user->sigpending) <
-                       t->rlim[RLIMIT_SIGPENDING].rlim_cur)
-               q = kmem_cache_alloc(sigqueue_cachep, GFP_ATOMIC);
-
+       q = __sigqueue_alloc(t, GFP_ATOMIC, (sig < SIGRTMIN &&
+                                            (is_si_special(info) ||
+                                             info->si_code >= 0)));
        if (q) {
-               q->flags = 0;
-               q->user = get_uid(t->user);
-               atomic_inc(&q->user->sigpending);
                list_add_tail(&q->list, &signals->list);
                switch ((unsigned long) info) {
-               case 0:
+               case (unsigned long) SEND_SIG_NOINFO:
                        q->info.si_signo = sig;
                        q->info.si_errno = 0;
                        q->info.si_code = SI_USER;
                        q->info.si_pid = current->pid;
                        q->info.si_uid = current->uid;
                        break;
-               case 1:
+               case (unsigned long) SEND_SIG_PRIV:
                        q->info.si_signo = sig;
                        q->info.si_errno = 0;
                        q->info.si_code = SI_KERNEL;
@@ -800,20 +862,13 @@ static int send_signal(int sig, struct siginfo *info, struct task_struct *t,
                        copy_siginfo(&q->info, info);
                        break;
                }
-       } else {
-               if (sig >= SIGRTMIN && info && (unsigned long)info != 1
-                  && info->si_code != SI_USER)
+       } else if (!is_si_special(info)) {
+               if (sig >= SIGRTMIN && info->si_code != SI_USER)
                /*
                 * Queue overflow, abort.  We may abort if the signal was rt
                 * and sent by user using something other than kill().
                 */
                        return -EAGAIN;
-               if (((unsigned long)info > 1) && (info->si_code == SI_TIMER))
-                       /*
-                        * Set up a return to indicate that we dropped 
-                        * the signal.
-                        */
-                       ret = info->si_sys_private;
        }
 
 out_set:
@@ -832,16 +887,7 @@ specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
 
        if (!irqs_disabled())
                BUG();
-#ifdef CONFIG_SMP
-       if (!spin_is_locked(&t->sighand->siglock))
-               BUG();
-#endif
-
-       if (((unsigned long)info > 2) && (info->si_code == SI_TIMER))
-               /*
-                * Set up a return to indicate that we dropped the signal.
-                */
-               ret = info->si_sys_private;
+       assert_spin_locked(&t->sighand->siglock);
 
        /* Short-circuit ignored signals.  */
        if (sig_ignored(t, sig))
@@ -872,11 +918,13 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
        int ret;
 
        spin_lock_irqsave(&t->sighand->siglock, flags);
-       if (sigismember(&t->blocked, sig) || t->sighand->action[sig-1].sa.sa_handler == SIG_IGN) {
+       if (t->sighand->action[sig-1].sa.sa_handler == SIG_IGN) {
                t->sighand->action[sig-1].sa.sa_handler = SIG_DFL;
+       }
+       if (sigismember(&t->blocked, sig)) {
                sigdelset(&t->blocked, sig);
-               recalc_sigpending_tsk(t);
        }
+       recalc_sigpending_tsk(t);
        ret = specific_send_sig_info(sig, info, t);
        spin_unlock_irqrestore(&t->sighand->siglock, flags);
 
@@ -886,15 +934,7 @@ force_sig_info(int sig, struct siginfo *info, struct task_struct *t)
 void
 force_sig_specific(int sig, struct task_struct *t)
 {
-       unsigned long int flags;
-
-       spin_lock_irqsave(&t->sighand->siglock, flags);
-       if (t->sighand->action[sig-1].sa.sa_handler == SIG_IGN)
-               t->sighand->action[sig-1].sa.sa_handler = SIG_DFL;
-       sigdelset(&t->blocked, sig);
-       recalc_sigpending_tsk(t);
-       specific_send_sig_info(sig, (void *)2, t);
-       spin_unlock_irqrestore(&t->sighand->siglock, flags);
+       force_sig_info(sig, SEND_SIG_FORCED, t);
 }
 
 /*
@@ -905,34 +945,31 @@ force_sig_specific(int sig, struct task_struct *t)
  * as soon as they're available, so putting the signal on the shared queue
  * will be equivalent to sending it to one such thread.
  */
-#define wants_signal(sig, p, mask)                     \
-       (!sigismember(&(p)->blocked, sig)               \
-        && !((p)->state & mask)                        \
-        && !((p)->flags & PF_EXITING)                  \
-        && (task_curr(p) || !signal_pending(p)))
-
+static inline int wants_signal(int sig, struct task_struct *p)
+{
+       if (sigismember(&p->blocked, sig))
+               return 0;
+       if (p->flags & PF_EXITING)
+               return 0;
+       if (sig == SIGKILL)
+               return 1;
+       if (p->state & (TASK_STOPPED | TASK_TRACED))
+               return 0;
+       return task_curr(p) || !signal_pending(p);
+}
 
 static void
 __group_complete_signal(int sig, struct task_struct *p)
 {
-       unsigned int mask;
        struct task_struct *t;
 
-       /*
-        * Don't bother zombies and stopped tasks (but
-        * SIGKILL will punch through stopped state)
-        */
-       mask = TASK_DEAD | TASK_ZOMBIE | TASK_TRACED;
-       if (sig != SIGKILL)
-               mask |= TASK_STOPPED;
-
        /*
         * Now find a thread we can wake up to take the signal off the queue.
         *
         * If the main thread wants the signal, it gets first crack.
         * Probably the least surprising to the average bear.
         */
-       if (wants_signal(sig, p, mask))
+       if (wants_signal(sig, p))
                t = p;
        else if (thread_group_empty(p))
                /*
@@ -948,9 +985,8 @@ __group_complete_signal(int sig, struct task_struct *p)
                if (t == NULL)
                        /* restart balancing at this thread */
                        t = p->signal->curr_target = p;
-               BUG_ON(t->tgid != p->tgid);
 
-               while (!wants_signal(sig, t, mask)) {
+               while (!wants_signal(sig, t)) {
                        t = next_thread(t);
                        if (t == p->signal->curr_target)
                                /*
@@ -967,7 +1003,7 @@ __group_complete_signal(int sig, struct task_struct *p)
         * Found a killable thread.  If the signal will be fatal,
         * then start taking the whole group down immediately.
         */
-       if (sig_fatal(p, sig) && !p->signal->group_exit &&
+       if (sig_fatal(p, sig) && !(p->signal->flags & SIGNAL_GROUP_EXIT) &&
            !sigismember(&t->real_blocked, sig) &&
            (sig == SIGKILL || !(t->ptrace & PT_PTRACED))) {
                /*
@@ -980,7 +1016,7 @@ __group_complete_signal(int sig, struct task_struct *p)
                         * running and doing things after a slower
                         * thread has the fatal signal pending.
                         */
-                       p->signal->group_exit = 1;
+                       p->signal->flags = SIGNAL_GROUP_EXIT;
                        p->signal->group_exit_code = sig;
                        p->signal->group_stop_count = 0;
                        t = p;
@@ -1024,23 +1060,14 @@ __group_complete_signal(int sig, struct task_struct *p)
        return;
 }
 
-static int
+int
 __group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
 {
        int ret = 0;
 
-#ifdef CONFIG_SMP
-       if (!spin_is_locked(&p->sighand->siglock))
-               BUG();
-#endif
+       assert_spin_locked(&p->sighand->siglock);
        handle_stop_signal(sig, p);
 
-       if (((unsigned long)info > 2) && (info->si_code == SI_TIMER))
-               /*
-                * Set up a return to indicate that we dropped the signal.
-                */
-               ret = info->si_sys_private;
-
        /* Short-circuit ignored signals.  */
        if (sig_ignored(p, sig))
                return ret;
@@ -1069,6 +1096,7 @@ void zap_other_threads(struct task_struct *p)
 {
        struct task_struct *t;
 
+       p->signal->flags = SIGNAL_GROUP_EXIT;
        p->signal->group_stop_count = 0;
 
        if (thread_group_empty(p))
@@ -1078,7 +1106,7 @@ void zap_other_threads(struct task_struct *p)
                /*
                 * Don't bother with already dead threads
                 */
-               if (t->state & (TASK_ZOMBIE|TASK_DEAD))
+               if (t->exit_state)
                        continue;
 
                /*
@@ -1092,25 +1120,36 @@ void zap_other_threads(struct task_struct *p)
                if (t != p->group_leader)
                        t->exit_signal = -1;
 
+               /* SIGKILL will be handled before any pending SIGSTOP */
                sigaddset(&t->pending.signal, SIGKILL);
-               rm_from_queue(SIG_KERNEL_STOP_MASK, &t->pending);
                signal_wake_up(t, 1);
        }
 }
 
 /*
- * Must be called with the tasklist_lock held for reading!
+ * Must be called under rcu_read_lock() or with tasklist_lock read-held.
  */
 int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
 {
        unsigned long flags;
+       struct sighand_struct *sp;
        int ret;
 
+retry:
        ret = check_kill_permission(sig, info, p);
-       if (!ret && sig && p->sighand) {
-               spin_lock_irqsave(&p->sighand->siglock, flags);
+       if (!ret && sig && (sp = rcu_dereference(p->sighand))) {
+               spin_lock_irqsave(&sp->siglock, flags);
+               if (p->sighand != sp) {
+                       spin_unlock_irqrestore(&sp->siglock, flags);
+                       goto retry;
+               }
+               if ((atomic_read(&sp->count) == 0) ||
+                               (atomic_read(&p->usage) == 0)) {
+                       spin_unlock_irqrestore(&sp->siglock, flags);
+                       return -ESRCH;
+               }
                ret = __group_send_sig_info(sig, info, p);
-               spin_unlock_irqrestore(&p->sighand->siglock, flags);
+               spin_unlock_irqrestore(&sp->siglock, flags);
        }
 
        return ret;
@@ -1123,7 +1162,7 @@ int group_send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
 
 int __kill_pg_info(int sig, struct siginfo *info, pid_t pgrp)
 {
-       struct task_struct *p;
+       struct task_struct *p = NULL;
        int retval, success;
 
        if (pgrp <= 0)
@@ -1151,51 +1190,61 @@ kill_pg_info(int sig, struct siginfo *info, pid_t pgrp)
        return retval;
 }
 
-/*
- * kill_sl_info() sends a signal to the session leader: this is used
- * to send SIGHUP to the controlling process of a terminal when
- * the connection is lost.
- */
-
-
 int
-kill_sl_info(int sig, struct siginfo *info, pid_t sid)
+kill_proc_info(int sig, struct siginfo *info, pid_t pid)
 {
-       int err, retval = -EINVAL;
+       int error;
+       int acquired_tasklist_lock = 0;
        struct task_struct *p;
 
-       if (sid <= 0)
-               goto out;
-
-       retval = -ESRCH;
-       read_lock(&tasklist_lock);
-       do_each_task_pid(sid, PIDTYPE_SID, p) {
-               if (!p->signal->leader)
-                       continue;
-               err = group_send_sig_info(sig, info, p);
-               if (retval)
-                       retval = err;
-       } while_each_task_pid(sid, PIDTYPE_SID, p);
-       read_unlock(&tasklist_lock);
-out:
-       return retval;
+       rcu_read_lock();
+       if (unlikely(sig_kernel_stop(sig) || sig == SIGCONT)) {
+               read_lock(&tasklist_lock);
+               acquired_tasklist_lock = 1;
+       }
+       p = find_task_by_pid(pid);
+       error = -ESRCH;
+       if (p && vx_check(vx_task_xid(p), VX_IDENT))
+               error = group_send_sig_info(sig, info, p);
+       if (unlikely(acquired_tasklist_lock))
+               read_unlock(&tasklist_lock);
+       rcu_read_unlock();
+       return error;
 }
 
-int
-kill_proc_info(int sig, struct siginfo *info, pid_t pid)
+/* like kill_proc_info(), but doesn't use uid/euid of "current" */
+int kill_proc_info_as_uid(int sig, struct siginfo *info, pid_t pid,
+                     uid_t uid, uid_t euid)
 {
-       int error;
+       int ret = -EINVAL;
        struct task_struct *p;
 
+       if (!valid_signal(sig))
+               return ret;
+
        read_lock(&tasklist_lock);
        p = find_task_by_pid(pid);
-       error = -ESRCH;
-       if (p)
-               error = group_send_sig_info(sig, info, p);
+       if (!p) {
+               ret = -ESRCH;
+               goto out_unlock;
+       }
+       if ((info == SEND_SIG_NOINFO || (!is_si_special(info) && SI_FROMUSER(info)))
+           && (euid != p->suid) && (euid != p->uid)
+           && (uid != p->suid) && (uid != p->uid)) {
+               ret = -EPERM;
+               goto out_unlock;
+       }
+       if (sig && p->sighand) {
+               unsigned long flags;
+               spin_lock_irqsave(&p->sighand->siglock, flags);
+               ret = __group_send_sig_info(sig, info, p);
+               spin_unlock_irqrestore(&p->sighand->siglock, flags);
+       }
+out_unlock:
        read_unlock(&tasklist_lock);
-       return error;
+       return ret;
 }
-
+EXPORT_SYMBOL_GPL(kill_proc_info_as_uid);
 
 /*
  * kill_something_info() interprets pid in interesting ways just like kill(2).
@@ -1214,7 +1263,8 @@ static int kill_something_info(int sig, struct siginfo *info, int pid)
 
                read_lock(&tasklist_lock);
                for_each_process(p) {
-                       if (p->pid > 1 && p->tgid != current->tgid) {
+                       if (vx_check(vx_task_xid(p), VX_ADMIN|VX_IDENT)&&
+                               p->pid > 1 && p->tgid != current->tgid) {
                                int err = group_send_sig_info(sig, info, p);
                                ++count;
                                if (err != -EPERM)
@@ -1248,7 +1298,7 @@ send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
         * Make sure legacy kernel users don't send in bad values
         * (normal paths check this in check_kill_permission).
         */
-       if (sig < 0 || sig > _NSIG)
+       if (!valid_signal(sig))
                return -EINVAL;
 
        /*
@@ -1265,10 +1315,13 @@ send_sig_info(int sig, struct siginfo *info, struct task_struct *p)
        return ret;
 }
 
+#define __si_special(priv) \
+       ((priv) ? SEND_SIG_PRIV : SEND_SIG_NOINFO)
+
 int
 send_sig(int sig, struct task_struct *p, int priv)
 {
-       return send_sig_info(sig, (void*)(long)(priv != 0), p);
+       return send_sig_info(sig, __si_special(priv), p);
 }
 
 /*
@@ -1288,7 +1341,7 @@ send_group_sig_info(int sig, struct siginfo *info, struct task_struct *p)
 void
 force_sig(int sig, struct task_struct *p)
 {
-       force_sig_info(sig, (void*)1L, p);
+       force_sig_info(sig, SEND_SIG_PRIV, p);
 }
 
 /*
@@ -1313,19 +1366,13 @@ force_sigsegv(int sig, struct task_struct *p)
 int
 kill_pg(pid_t pgrp, int sig, int priv)
 {
-       return kill_pg_info(sig, (void *)(long)(priv != 0), pgrp);
-}
-
-int
-kill_sl(pid_t sess, int sig, int priv)
-{
-       return kill_sl_info(sig, (void *)(long)(priv != 0), sess);
+       return kill_pg_info(sig, __si_special(priv), pgrp);
 }
 
 int
 kill_proc(pid_t pid, int sig, int priv)
 {
-       return kill_proc_info(sig, (void *)(long)(priv != 0), pid);
+       return kill_proc_info(sig, __si_special(priv), pid);
 }
 
 /*
@@ -1342,7 +1389,7 @@ struct sigqueue *sigqueue_alloc(void)
 {
        struct sigqueue *q;
 
-       if ((q = __sigqueue_alloc()))
+       if ((q = __sigqueue_alloc(current, GFP_KERNEL, 0)))
                q->flags |= SIGQUEUE_PREALLOC;
        return(q);
 }
@@ -1356,11 +1403,12 @@ void sigqueue_free(struct sigqueue *q)
         * pending queue.
         */
        if (unlikely(!list_empty(&q->list))) {
-               read_lock(&tasklist_lock);  
-               spin_lock_irqsave(q->lock, flags);
+               spinlock_t *lock = &current->sighand->siglock;
+               read_lock(&tasklist_lock);
+               spin_lock_irqsave(lock, flags);
                if (!list_empty(&q->list))
                        list_del_init(&q->list);
-               spin_unlock_irqrestore(q->lock, flags);
+               spin_unlock_irqrestore(lock, flags);
                read_unlock(&tasklist_lock);
        }
        q->flags &= ~SIGQUEUE_PREALLOC;
@@ -1372,17 +1420,55 @@ send_sigqueue(int sig, struct sigqueue *q, struct task_struct *p)
 {
        unsigned long flags;
        int ret = 0;
+       struct sighand_struct *sh;
+
+       BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
 
        /*
-        * We need the tasklist lock even for the specific
-        * thread case (when we don't need to follow the group
-        * lists) in order to avoid races with "p->sighand"
-        * going away or changing from under us.
+        * The rcu based delayed sighand destroy makes it possible to
+        * run this without tasklist lock held. The task struct itself
+        * cannot go away as create_timer did get_task_struct().
+        *
+        * We return -1, when the task is marked exiting, so
+        * posix_timer_event can redirect it to the group leader
         */
-       BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
-       read_lock(&tasklist_lock);  
-       spin_lock_irqsave(&p->sighand->siglock, flags);
-       
+       rcu_read_lock();
+
+       if (unlikely(p->flags & PF_EXITING)) {
+               ret = -1;
+               goto out_err;
+       }
+
+retry:
+       sh = rcu_dereference(p->sighand);
+
+       spin_lock_irqsave(&sh->siglock, flags);
+       if (p->sighand != sh) {
+               /* We raced with exec() in a multithreaded process... */
+               spin_unlock_irqrestore(&sh->siglock, flags);
+               goto retry;
+       }
+
+       /*
+        * We do the check here again to handle the following scenario:
+        *
+        * CPU 0                CPU 1
+        * send_sigqueue
+        * check PF_EXITING
+        * interrupt            exit code running
+        *                      __exit_signal
+        *                      lock sighand->siglock
+        *                      unlock sighand->siglock
+        * lock sh->siglock
+        * add(tsk->pending)    flush_sigqueue(tsk->pending)
+        *
+        */
+
+       if (unlikely(p->flags & PF_EXITING)) {
+               ret = -1;
+               goto out;
+       }
+
        if (unlikely(!list_empty(&q->list))) {
                /*
                 * If an SI_TIMER entry is already queue just increment
@@ -1392,23 +1478,24 @@ send_sigqueue(int sig, struct sigqueue *q, struct task_struct *p)
                        BUG();
                q->info.si_overrun++;
                goto out;
-       } 
+       }
        /* Short-circuit ignored signals.  */
        if (sig_ignored(p, sig)) {
                ret = 1;
                goto out;
        }
 
-       q->lock = &p->sighand->siglock;
        list_add_tail(&q->list, &p->pending.list);
        sigaddset(&p->pending.signal, sig);
        if (!sigismember(&p->blocked, sig))
                signal_wake_up(p, sig == SIGKILL);
 
 out:
-       spin_unlock_irqrestore(&p->sighand->siglock, flags);
-       read_unlock(&tasklist_lock);
-       return(ret);
+       spin_unlock_irqrestore(&sh->siglock, flags);
+out_err:
+       rcu_read_unlock();
+
+       return ret;
 }
 
 int
@@ -1418,7 +1505,9 @@ send_group_sigqueue(int sig, struct sigqueue *q, struct task_struct *p)
        int ret = 0;
 
        BUG_ON(!(q->flags & SIGQUEUE_PREALLOC));
+
        read_lock(&tasklist_lock);
+       /* Since it_lock is held, p->sighand cannot be NULL. */
        spin_lock_irqsave(&p->sighand->siglock, flags);
        handle_stop_signal(sig, p);
 
@@ -1445,7 +1534,6 @@ send_group_sigqueue(int sig, struct sigqueue *q, struct task_struct *p)
         * We always use the shared queue for process-wide signals,
         * to avoid several races.
         */
-       q->lock = &p->sighand->siglock;
        list_add_tail(&q->list, &p->signal->shared_pending.list);
        sigaddset(&p->signal->shared_pending.signal, sig);
 
@@ -1453,32 +1541,16 @@ send_group_sigqueue(int sig, struct sigqueue *q, struct task_struct *p)
 out:
        spin_unlock_irqrestore(&p->sighand->siglock, flags);
        read_unlock(&tasklist_lock);
-       return(ret);
+       return ret;
 }
 
 /*
- * Joy. Or not. Pthread wants us to wake up every thread
- * in our parent group.
+ * Wake up any threads in the parent blocked in wait* syscalls.
  */
-static void __wake_up_parent(struct task_struct *p,
+static inline void __wake_up_parent(struct task_struct *p,
                                    struct task_struct *parent)
 {
-       struct task_struct *tsk = parent;
-
-       /*
-        * Fortunately this is not necessary for thread groups:
-        */
-       if (p->tgid == tsk->tgid) {
-               wake_up_interruptible_sync(&tsk->wait_chldexit);
-               return;
-       }
-
-       do {
-               wake_up_interruptible_sync(&tsk->wait_chldexit);
-               tsk = next_thread(tsk);
-               if (tsk->signal != parent->signal)
-                       BUG();
-       } while (tsk != parent);
+       wake_up_interruptible_sync(&parent->signal->wait_chldexit);
 }
 
 /*
@@ -1492,8 +1564,7 @@ void do_notify_parent(struct task_struct *tsk, int sig)
        unsigned long flags;
        struct sighand_struct *psig;
 
-       if (sig == -1)
-               BUG();
+       BUG_ON(sig == -1);
 
        /* do_notify_parent_cldstop should have been called instead.  */
        BUG_ON(tsk->state & (TASK_STOPPED|TASK_TRACED));
@@ -1507,8 +1578,10 @@ void do_notify_parent(struct task_struct *tsk, int sig)
        info.si_uid = tsk->uid;
 
        /* FIXME: find out whether or not this is supposed to be c*time. */
-       info.si_utime = tsk->utime + tsk->signal->utime;
-       info.si_stime = tsk->stime + tsk->signal->stime;
+       info.si_utime = cputime_to_jiffies(cputime_add(tsk->utime,
+                                                      tsk->signal->utime));
+       info.si_stime = cputime_to_jiffies(cputime_add(tsk->stime,
+                                                      tsk->signal->stime));
 
        info.si_status = tsk->exit_code & 0x7f;
        if (tsk->exit_code & 0x80)
@@ -1522,7 +1595,7 @@ void do_notify_parent(struct task_struct *tsk, int sig)
 
        psig = tsk->parent->sighand;
        spin_lock_irqsave(&psig->siglock, flags);
-       if (sig == SIGCHLD &&
+       if (!tsk->ptrace && sig == SIGCHLD &&
            (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN ||
             (psig->action[SIGCHLD-1].sa.sa_flags & SA_NOCLDWAIT))) {
                /*
@@ -1544,28 +1617,34 @@ void do_notify_parent(struct task_struct *tsk, int sig)
                if (psig->action[SIGCHLD-1].sa.sa_handler == SIG_IGN)
                        sig = 0;
        }
-       if (sig > 0 && sig <= _NSIG)
+       if (valid_signal(sig) && sig > 0)
                __group_send_sig_info(sig, &info, tsk->parent);
        __wake_up_parent(tsk, tsk->parent);
        spin_unlock_irqrestore(&psig->siglock, flags);
 }
 
-static void
-do_notify_parent_cldstop(struct task_struct *tsk, struct task_struct *parent,
-                        int why)
+static void do_notify_parent_cldstop(struct task_struct *tsk, int to_self, int why)
 {
        struct siginfo info;
        unsigned long flags;
+       struct task_struct *parent;
        struct sighand_struct *sighand;
 
+       if (to_self)
+               parent = tsk->parent;
+       else {
+               tsk = tsk->group_leader;
+               parent = tsk->real_parent;
+       }
+
        info.si_signo = SIGCHLD;
        info.si_errno = 0;
        info.si_pid = tsk->pid;
        info.si_uid = tsk->uid;
 
        /* FIXME: find out whether or not this is supposed to be c*time. */
-       info.si_utime = tsk->utime;
-       info.si_stime = tsk->stime;
+       info.si_utime = cputime_to_jiffies(tsk->utime);
+       info.si_stime = cputime_to_jiffies(tsk->stime);
 
        info.si_code = why;
        switch (why) {
@@ -1601,11 +1680,12 @@ do_notify_parent_cldstop(struct task_struct *tsk, struct task_struct *parent,
  * We always set current->last_siginfo while stopped here.
  * That makes it a way to test a stopped process for
  * being ptrace-stopped vs being job-control-stopped.
+ *
+ * If we actually decide not to stop at all because the tracer is gone,
+ * we leave nostop_code in current->exit_code.
  */
-static void ptrace_stop(int exit_code, siginfo_t *info)
+static void ptrace_stop(int exit_code, int nostop_code, siginfo_t *info)
 {
-       BUG_ON(!(current->ptrace & PT_PTRACED));
-
        /*
         * If there is a group stop in progress,
         * we must participate in the bookkeeping.
@@ -1619,10 +1699,25 @@ static void ptrace_stop(int exit_code, siginfo_t *info)
        /* Let the debugger run.  */
        set_current_state(TASK_TRACED);
        spin_unlock_irq(&current->sighand->siglock);
+       try_to_freeze();
        read_lock(&tasklist_lock);
-       do_notify_parent_cldstop(current, current->parent, CLD_TRAPPED);
-       read_unlock(&tasklist_lock);
-       schedule();
+       if (likely(current->ptrace & PT_PTRACED) &&
+           likely(current->parent != current->real_parent ||
+                  !(current->ptrace & PT_ATTACHED)) &&
+           (likely(current->parent->signal != current->signal) ||
+            !unlikely(current->signal->flags & SIGNAL_GROUP_EXIT))) {
+               do_notify_parent_cldstop(current, 1, CLD_TRAPPED);
+               read_unlock(&tasklist_lock);
+               schedule();
+       } else {
+               /*
+                * By the time we got the lock, our tracer went away.
+                * Don't stop here.
+                */
+               read_unlock(&tasklist_lock);
+               set_current_state(TASK_RUNNING);
+               current->exit_code = nostop_code;
+       }
 
        /*
         * We are back.  Now reacquire the siglock before touching
@@ -1653,34 +1748,32 @@ void ptrace_notify(int exit_code)
 
        /* Let the debugger run.  */
        spin_lock_irq(&current->sighand->siglock);
-       ptrace_stop(exit_code, &info);
+       ptrace_stop(exit_code, 0, &info);
        spin_unlock_irq(&current->sighand->siglock);
 }
 
-#ifndef HAVE_ARCH_GET_SIGNAL_TO_DELIVER
-
 static void
 finish_stop(int stop_count)
 {
+       int to_self;
+
        /*
         * If there are no other threads in the group, or if there is
         * a group stop in progress and we are the last to stop,
         * report to the parent.  When ptraced, every thread reports itself.
         */
-       if (stop_count < 0 || (current->ptrace & PT_PTRACED)) {
-               read_lock(&tasklist_lock);
-               do_notify_parent_cldstop(current, current->parent,
-                                        CLD_STOPPED);
-               read_unlock(&tasklist_lock);
-       }
-       else if (stop_count == 0) {
-               read_lock(&tasklist_lock);
-               do_notify_parent_cldstop(current->group_leader,
-                                        current->group_leader->real_parent,
-                                        CLD_STOPPED);
-               read_unlock(&tasklist_lock);
-       }
+       if (stop_count < 0 || (current->ptrace & PT_PTRACED))
+               to_self = 1;
+       else if (stop_count == 0)
+               to_self = 0;
+       else
+               goto out;
 
+       read_lock(&tasklist_lock);
+       do_notify_parent_cldstop(current, to_self, CLD_STOPPED);
+       read_unlock(&tasklist_lock);
+
+out:
        schedule();
        /*
         * Now we don't run again until continued.
@@ -1691,15 +1784,18 @@ finish_stop(int stop_count)
 /*
  * This performs the stopping for SIGSTOP and other stop signals.
  * We have to stop all threads in the thread group.
+ * Returns nonzero if we've actually stopped and released the siglock.
+ * Returns zero if we didn't stop and still hold the siglock.
  */
-static void
+static int
 do_signal_stop(int signr)
 {
        struct signal_struct *sig = current->signal;
        struct sighand_struct *sighand = current->sighand;
        int stop_count = -1;
 
-       /* spin_lock_irq(&sighand->siglock) is now done in caller */
+       if (!likely(sig->flags & SIGNAL_STOP_DEQUEUED))
+               return 0;
 
        if (sig->group_stop_count > 0) {
                /*
@@ -1711,7 +1807,7 @@ do_signal_stop(int signr)
                current->exit_code = signr;
                set_current_state(TASK_STOPPED);
                if (stop_count == 0)
-                       sig->stop_state = 1;
+                       sig->flags = SIGNAL_STOP_STOPPED;
                spin_unlock_irq(&sighand->siglock);
        }
        else if (thread_group_empty(current)) {
@@ -1720,7 +1816,7 @@ do_signal_stop(int signr)
                 */
                current->exit_code = current->signal->group_exit_code = signr;
                set_current_state(TASK_STOPPED);
-               sig->stop_state = 1;
+               sig->flags = SIGNAL_STOP_STOPPED;
                spin_unlock_irq(&sighand->siglock);
        }
        else {
@@ -1741,25 +1837,17 @@ do_signal_stop(int signr)
                read_lock(&tasklist_lock);
                spin_lock_irq(&sighand->siglock);
 
-               if (unlikely(sig->group_exit)) {
-                       /*
-                        * There is a group exit in progress now.
-                        * We'll just ignore the stop and process the
-                        * associated fatal signal.
-                        */
-                       spin_unlock_irq(&sighand->siglock);
-                       read_unlock(&tasklist_lock);
-                       return;
-               }
-
-               if (unlikely(sig_avoid_stop_race())) {
+               if (!likely(sig->flags & SIGNAL_STOP_DEQUEUED)) {
                        /*
-                        * Either a SIGCONT or a SIGKILL signal was
-                        * posted in the siglock-not-held window.
+                        * Another stop or continue happened while we
+                        * didn't have the lock.  We can just swallow this
+                        * signal now.  If we raced with a SIGCONT, that
+                        * should have just cleared it now.  If we raced
+                        * with another processor delivering a stop signal,
+                        * then the SIGCONT that wakes us up should clear it.
                         */
-                       spin_unlock_irq(&sighand->siglock);
                        read_unlock(&tasklist_lock);
-                       return;
+                       return 0;
                }
 
                if (sig->group_stop_count == 0) {
@@ -1772,7 +1860,8 @@ do_signal_stop(int signr)
                                 * stop is always done with the siglock held,
                                 * so this check has no races.
                                 */
-                               if (t->state < TASK_STOPPED) {
+                               if (!t->exit_state &&
+                                   !(t->state & (TASK_STOPPED|TASK_TRACED))) {
                                        stop_count++;
                                        signal_wake_up(t, 0);
                                }
@@ -1787,13 +1876,14 @@ do_signal_stop(int signr)
                current->exit_code = signr;
                set_current_state(TASK_STOPPED);
                if (stop_count == 0)
-                       sig->stop_state = 1;
+                       sig->flags = SIGNAL_STOP_STOPPED;
 
                spin_unlock_irq(&sighand->siglock);
                read_unlock(&tasklist_lock);
        }
 
        finish_stop(stop_count);
+       return 1;
 }
 
 /*
@@ -1802,7 +1892,7 @@ do_signal_stop(int signr)
  * We return zero if we still hold the siglock and should look
  * for another signal without checking group_stop_count again.
  */
-static inline int handle_group_stop(void)
+static int handle_group_stop(void)
 {
        int stop_count;
 
@@ -1815,7 +1905,7 @@ static inline int handle_group_stop(void)
                return 0;
        }
 
-       if (current->signal->group_exit)
+       if (current->signal->flags & SIGNAL_GROUP_EXIT)
                /*
                 * Group stop is so another thread can do a core dump,
                 * or else we are racing against a death signal.
@@ -1829,7 +1919,7 @@ static inline int handle_group_stop(void)
         */
        stop_count = --current->signal->group_stop_count;
        if (stop_count == 0)
-               current->signal->stop_state = 1;
+               current->signal->flags = SIGNAL_STOP_STOPPED;
        current->exit_code = current->signal->group_exit_code;
        set_current_state(TASK_STOPPED);
        spin_unlock_irq(&current->sighand->siglock);
@@ -1861,7 +1951,7 @@ relock:
                        ptrace_signal_deliver(regs, cookie);
 
                        /* Let the debugger run.  */
-                       ptrace_stop(signr, info);
+                       ptrace_stop(signr, signr, info);
 
                        /* We're back.  Did the debugger cancel the sig?  */
                        signr = current->exit_code;
@@ -1912,6 +2002,11 @@ relock:
                if (current->pid == 1)
                        continue;
 
+               /* virtual init is protected against user signals */
+               if ((info->si_code == SI_USER) &&
+                       vx_current_initpid(current->pid))
+                       continue;
+
                if (sig_kernel_stop(signr)) {
                        /*
                         * The default action is to stop all threads in
@@ -1923,28 +2018,27 @@ relock:
                         * This allows an intervening SIGCONT to be posted.
                         * We need to check for that and bail out if necessary.
                         */
-                       if (signr == SIGSTOP) {
-                               do_signal_stop(signr); /* releases siglock */
-                               goto relock;
-                       }
-                       spin_unlock_irq(&current->sighand->siglock);
+                       if (signr != SIGSTOP) {
+                               spin_unlock_irq(&current->sighand->siglock);
 
-                       /* signals can be posted during this window */
+                               /* signals can be posted during this window */
 
-                       if (is_orphaned_pgrp(process_group(current)))
-                               goto relock;
+                               if (is_orphaned_pgrp(process_group(current)))
+                                       goto relock;
 
-                       spin_lock_irq(&current->sighand->siglock);
-                       if (unlikely(sig_avoid_stop_race())) {
-                               /*
-                                * Either a SIGCONT or a SIGKILL signal was
-                                * posted in the siglock-not-held window.
-                                */
-                               continue;
+                               spin_lock_irq(&current->sighand->siglock);
                        }
 
-                       do_signal_stop(signr); /* releases siglock */
-                       goto relock;
+                       if (likely(do_signal_stop(signr))) {
+                               /* It released the siglock.  */
+                               goto relock;
+                       }
+
+                       /*
+                        * We didn't actually stop, due to a race
+                        * with SIGCONT or something like that.
+                        */
+                       continue;
                }
 
                spin_unlock_irq(&current->sighand->siglock);
@@ -1953,22 +2047,16 @@ relock:
                 * Anything else is fatal, maybe with a core dump.
                 */
                current->flags |= PF_SIGNALED;
-               if (sig_kernel_coredump(signr) &&
-                   do_coredump((long)signr, signr, regs)) {
+               if (sig_kernel_coredump(signr)) {
                        /*
-                        * That killed all other threads in the group and
-                        * synchronized with their demise, so there can't
-                        * be any more left to kill now.  The group_exit
-                        * flags are set by do_coredump.  Note that
-                        * thread_group_empty won't always be true yet,
-                        * because those threads were blocked in __exit_mm
-                        * and we just let them go to finish dying.
+                        * If it was able to dump core, this kills all
+                        * other threads in the group and synchronizes with
+                        * their demise.  If we lost the race with another
+                        * thread getting here, it set group_exit_code
+                        * first and our do_group_exit call below will use
+                        * that value and ignore the one we pass it.
                         */
-                       const int code = signr | 0x80;
-                       BUG_ON(!current->signal->group_exit);
-                       BUG_ON(current->signal->group_exit_code != code);
-                       do_exit(code);
-                       /* NOTREACHED */
+                       do_coredump((long)signr, signr, regs);
                }
 
                /*
@@ -1981,27 +2069,15 @@ relock:
        return signr;
 }
 
-#endif
-
 EXPORT_SYMBOL(recalc_sigpending);
 EXPORT_SYMBOL_GPL(dequeue_signal);
 EXPORT_SYMBOL(flush_signals);
 EXPORT_SYMBOL(force_sig);
-EXPORT_SYMBOL(force_sig_info);
 EXPORT_SYMBOL(kill_pg);
-EXPORT_SYMBOL(kill_pg_info);
 EXPORT_SYMBOL(kill_proc);
-EXPORT_SYMBOL(kill_proc_info);
-EXPORT_SYMBOL(kill_sl);
-EXPORT_SYMBOL(kill_sl_info);
 EXPORT_SYMBOL(ptrace_notify);
 EXPORT_SYMBOL(send_sig);
 EXPORT_SYMBOL(send_sig_info);
-EXPORT_SYMBOL(send_group_sig_info);
-EXPORT_SYMBOL(sigqueue_alloc);
-EXPORT_SYMBOL(sigqueue_free);
-EXPORT_SYMBOL(send_sigqueue);
-EXPORT_SYMBOL(send_group_sigqueue);
 EXPORT_SYMBOL(sigprocmask);
 EXPORT_SYMBOL(block_all_signals);
 EXPORT_SYMBOL(unblock_all_signals);
@@ -2245,9 +2321,9 @@ sys_rt_sigtimedwait(const sigset_t __user *uthese,
                        recalc_sigpending();
                        spin_unlock_irq(&current->sighand->siglock);
 
-                       current->state = TASK_INTERRUPTIBLE;
-                       timeout = schedule_timeout(timeout);
+                       timeout = schedule_timeout_interruptible(timeout);
 
+                       try_to_freeze();
                        spin_lock_irq(&current->sighand->siglock);
                        sig = dequeue_signal(current, &these, &info);
                        current->blocked = current->real_blocked;
@@ -2286,26 +2362,13 @@ sys_kill(int pid, int sig)
        return kill_something_info(sig, &info, pid);
 }
 
-/**
- *  sys_tgkill - send signal to one specific thread
- *  @tgid: the thread group ID of the thread
- *  @pid: the PID of the thread
- *  @sig: signal to be sent
- *
- *  This syscall also checks the tgid and returns -ESRCH even if the PID
- *  exists but it's not belonging to the target process anymore. This
- *  method solves the problem of threads exiting and PIDs getting reused.
- */
-asmlinkage long sys_tgkill(int tgid, int pid, int sig)
+static int do_tkill(int tgid, int pid, int sig)
 {
-       struct siginfo info;
        int error;
+       struct siginfo info;
        struct task_struct *p;
 
-       /* This is only valid for single tasks */
-       if (pid <= 0 || tgid <= 0)
-               return -EINVAL;
-
+       error = -ESRCH;
        info.si_signo = sig;
        info.si_errno = 0;
        info.si_code = SI_TKILL;
@@ -2314,8 +2377,7 @@ asmlinkage long sys_tgkill(int tgid, int pid, int sig)
 
        read_lock(&tasklist_lock);
        p = find_task_by_pid(pid);
-       error = -ESRCH;
-       if (p && (p->tgid == tgid)) {
+       if (p && (tgid <= 0 || p->tgid == tgid)) {
                error = check_kill_permission(sig, &info, p);
                /*
                 * The null signal is a permissions and process existence
@@ -2329,47 +2391,40 @@ asmlinkage long sys_tgkill(int tgid, int pid, int sig)
                }
        }
        read_unlock(&tasklist_lock);
+
        return error;
 }
 
+/**
+ *  sys_tgkill - send signal to one specific thread
+ *  @tgid: the thread group ID of the thread
+ *  @pid: the PID of the thread
+ *  @sig: signal to be sent
+ *
+ *  This syscall also checks the tgid and returns -ESRCH even if the PID
+ *  exists but it's not belonging to the target process anymore. This
+ *  method solves the problem of threads exiting and PIDs getting reused.
+ */
+asmlinkage long sys_tgkill(int tgid, int pid, int sig)
+{
+       /* This is only valid for single tasks */
+       if (pid <= 0 || tgid <= 0)
+               return -EINVAL;
+
+       return do_tkill(tgid, pid, sig);
+}
+
 /*
  *  Send a signal to only one task, even if it's a CLONE_THREAD task.
  */
 asmlinkage long
 sys_tkill(int pid, int sig)
 {
-       struct siginfo info;
-       int error;
-       struct task_struct *p;
-
        /* This is only valid for single tasks */
        if (pid <= 0)
                return -EINVAL;
 
-       info.si_signo = sig;
-       info.si_errno = 0;
-       info.si_code = SI_TKILL;
-       info.si_pid = current->tgid;
-       info.si_uid = current->uid;
-
-       read_lock(&tasklist_lock);
-       p = find_task_by_pid(pid);
-       error = -ESRCH;
-       if (p) {
-               error = check_kill_permission(sig, &info, p);
-               /*
-                * The null signal is a permissions and process existence
-                * probe.  No signal is actually delivered.
-                */
-               if (!error && sig && p->sighand) {
-                       spin_lock_irq(&p->sighand->siglock);
-                       handle_stop_signal(sig, p);
-                       error = specific_send_sig_info(sig, &info, p);
-                       spin_unlock_irq(&p->sighand->siglock);
-               }
-       }
-       read_unlock(&tasklist_lock);
-       return error;
+       return do_tkill(0, pid, sig);
 }
 
 asmlinkage long
@@ -2391,11 +2446,12 @@ sys_rt_sigqueueinfo(int pid, int sig, siginfo_t __user *uinfo)
 }
 
 int
-do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
+do_sigaction(int sig, struct k_sigaction *act, struct k_sigaction *oact)
 {
        struct k_sigaction *k;
+       sigset_t mask;
 
-       if (sig < 1 || sig > _NSIG || (act && sig_kernel_only(sig)))
+       if (!valid_signal(sig) || sig < 1 || (act && sig_kernel_only(sig)))
                return -EINVAL;
 
        k = &current->sighand->action[sig-1];
@@ -2414,6 +2470,8 @@ do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
                *oact = *k;
 
        if (act) {
+               sigdelsetmask(&act->sa.sa_mask,
+                             sigmask(SIGKILL) | sigmask(SIGSTOP));
                /*
                 * POSIX 3.3.1.3:
                 *  "Setting a signal action to SIG_IGN for a signal that is
@@ -2439,11 +2497,11 @@ do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
                        read_lock(&tasklist_lock);
                        spin_lock_irq(&t->sighand->siglock);
                        *k = *act;
-                       sigdelsetmask(&k->sa.sa_mask,
-                                     sigmask(SIGKILL) | sigmask(SIGSTOP));
-                       rm_from_queue(sigmask(sig), &t->signal->shared_pending);
+                       sigemptyset(&mask);
+                       sigaddset(&mask, sig);
+                       rm_from_queue_full(&mask, &t->signal->shared_pending);
                        do {
-                               rm_from_queue(sigmask(sig), &t->pending);
+                               rm_from_queue_full(&mask, &t->pending);
                                recalc_sigpending_tsk(t);
                                t = next_thread(t);
                        } while (t != current);
@@ -2453,8 +2511,6 @@ do_sigaction(int sig, const struct k_sigaction *act, struct k_sigaction *oact)
                }
 
                *k = *act;
-               sigdelsetmask(&k->sa.sa_mask,
-                             sigmask(SIGKILL) | sigmask(SIGSTOP));
        }
 
        spin_unlock_irq(&current->sighand->siglock);
@@ -2479,7 +2535,7 @@ do_sigaltstack (const stack_t __user *uss, stack_t __user *uoss, unsigned long s
                int ss_flags;
 
                error = -EFAULT;
-               if (verify_area(VERIFY_READ, uss, sizeof(*uss))
+               if (!access_ok(VERIFY_READ, uss, sizeof(*uss))
                    || __get_user(ss_sp, &uss->ss_sp)
                    || __get_user(ss_flags, &uss->ss_flags)
                    || __get_user(ss_size, &uss->ss_size))
@@ -2660,6 +2716,7 @@ sys_signal(int sig, __sighandler_t handler)
 
        new_sa.sa.sa_handler = handler;
        new_sa.sa.sa_flags = SA_ONESHOT | SA_NOMASK;
+       sigemptyset(&new_sa.sa.sa_mask);
 
        ret = do_sigaction(sig, &new_sa, &old_sa);
 
@@ -2679,6 +2736,32 @@ sys_pause(void)
 
 #endif
 
+#ifdef __ARCH_WANT_SYS_RT_SIGSUSPEND
+asmlinkage long sys_rt_sigsuspend(sigset_t __user *unewset, size_t sigsetsize)
+{
+       sigset_t newset;
+
+       /* XXX: Don't preclude handling different sized sigset_t's.  */
+       if (sigsetsize != sizeof(sigset_t))
+               return -EINVAL;
+
+       if (copy_from_user(&newset, unewset, sizeof(newset)))
+               return -EFAULT;
+       sigdelsetmask(&newset, sigmask(SIGKILL)|sigmask(SIGSTOP));
+
+       spin_lock_irq(&current->sighand->siglock);
+       current->saved_sigmask = current->blocked;
+       current->blocked = newset;
+       recalc_sigpending();
+       spin_unlock_irq(&current->sighand->siglock);
+
+       current->state = TASK_INTERRUPTIBLE;
+       schedule();
+       set_thread_flag(TIF_RESTORE_SIGMASK);
+       return -ERESTARTNOHAND;
+}
+#endif /* __ARCH_WANT_SYS_RT_SIGSUSPEND */
+
 void __init signals_init(void)
 {
        sigqueue_cachep =