The patch titled
fill_tgid: fix task_struct leak and possible oops
has been added to the -mm tree. Its filename is
fill_tgid-fix-task_struct-leak-and-possible-oops.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: fill_tgid: fix task_struct leak and possible oops
From: Oleg Nesterov <oleg@xxxxxxxxxx>
1. fill_tgid() forgets to do put_task_struct(first).
2. release_task(first) can happen after fill_tgid() drops tasklist_lock,
it is unsafe to dereference first->signal.
This is a temporary fix, imho the locking should be reworked.
Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Cc: Shailabh Nagar <nagar@xxxxxxxxxxxxxx>
Cc: Balbir Singh <balbir@xxxxxxxxxx>
Cc: Jay Lan <jlan@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
kernel/taskstats.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff -puN kernel/taskstats.c~fill_tgid-fix-task_struct-leak-and-possible-oops kernel/taskstats.c
--- a/kernel/taskstats.c~fill_tgid-fix-task_struct-leak-and-possible-oops
+++ a/kernel/taskstats.c
@@ -237,14 +237,17 @@ static int fill_tgid(pid_t tgid, struct
} else
get_task_struct(first);
- /* Start with stats from dead tasks */
- spin_lock_irqsave(&first->signal->stats_lock, flags);
- if (first->signal->stats)
- memcpy(stats, first->signal->stats, sizeof(*stats));
- spin_unlock_irqrestore(&first->signal->stats_lock, flags);
tsk = first;
read_lock(&tasklist_lock);
+ /* Start with stats from dead tasks */
+ if (first->signal) {
+ spin_lock_irqsave(&first->signal->stats_lock, flags);
+ if (first->signal->stats)
+ memcpy(stats, first->signal->stats, sizeof(*stats));
+ spin_unlock_irqrestore(&first->signal->stats_lock, flags);
+ }
+
do {
if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
continue;
@@ -264,7 +267,7 @@ static int fill_tgid(pid_t tgid, struct
* Accounting subsytems can also add calls here to modify
* fields of taskstats.
*/
-
+ put_task_struct(first);
return 0;
}
_
Patches currently in -mm which might be from oleg@xxxxxxxxxx are
fill_tgid-fix-task_struct-leak-and-possible-oops.patch
bacct_add_tsk-fix-unsafe-and-wrong-parent-group_leader-dereference.patch
taskstats_tgid_free-fix-usage.patch
taskstats_tgid_alloc-optimization.patch
taskstats-kill-taskstats_lock-in-favor-of-siglock.patch
taskstats-dont-use-tasklist_lock.patch
tty-signal-tty-locking.patch
do_task_stat-dont-take-tty_mutex.patch
do_acct_process-dont-take-tty_mutex.patch
trivial-make-set_special_pids-static.patch
sys_unshare-remove-a-broken-clone_sighand-code.patch
add-process_session-helper-routine-deprecate-old-field-tidy-2.patch
sys_setpgid-eliminate-unnecessary-do_each_task_pidpidtype_pgid.patch
session_of_pgrp-kill-unnecessary-do_each_task_pidpidtype_pgid.patch
pidhash-temporary-debug-checks.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
