Kernel series fixes coredump UAF, truncated dumps, and hangs

A large fixes series from Christian Brauner tightens Linux coredump and signal handling after static analysis and TLA+ modeling turned up several long-standing races. The work is aimed at stable kernels and addresses crashes, truncated cores, hangs, and inconsistent freeze behavior that could hit multi-threaded processes, containers, and io_uring users.

The most severe issue is a use-after-free when finishing a dump. The dumper clears parked threads and wakes them without holding a reference or RCU protection. A parked thread can exit and be freed between those steps, so the subsequent wakeup can touch freed memory. The series holds RCU across that loop so the task structure stays valid until the wake completes.

Shared signals were also being retargeted onto the dumping thread. Once a group exit is underway no thread should dequeue those signals, yet a sibling restoring its mask after a crash wake could re-arm the dumper’s pending bit. Blocking writes then saw the pending signal and truncated the core. Retargeting now stops when the group is already exiting.

Freeze handling was inconsistent. Power-management and cgroup v1 freezes aborted an in-progress dump; cgroup v2’s freeze trap did not always do the same, so a dump to a file could finish while a dump to a pipe stopped mid-write. Signal-pending checks for a dumping task now treat SIGKILL and all three freezer paths the same way, so freezing always interrupts the dump.

Several io_uring interactions are cleaned up as well. An unordered exit bit against worker-creation task work could leave a reference held and hang the exit path on weakly ordered CPUs. Exec now cancels io_uring before the process is forced single-threaded, so a late worker cannot rejoin a group that de_thread() just dismantled. User workers are no longer allowed to dump, cannot have their signal mask cleared via ptrace, and are refused when the creator is already past the coredump barrier, preventing threads_remaining undercounts that let the dumper finish while a worker was still alive.

Other fixes cover a sysctl race on core_pattern (parsed from a snapshot), a deadlock releasing files from a failed fork under a scheduler lock, a lost SIGHUP when a session leader exited, and restoring highest-fd-first close order for deferred puts. Oleg Nesterov reviewed much of the series and suggested the exec ordering change; Jens Axboe reviewed the io-wq barrier.

Taken together, the patches make coredumps finish without racing their own parked threads or sibling signals, and stop freezer and io_uring edge cases from hanging groups or silently shortening crash dumps.