The patch titled
xacct_add_tsk: fix pure theoretical ->mm use-after-free
has been removed from the -mm tree. Its filename was
xacct_add_tsk-fix-pure-theoretical-mm-use-after-free.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: xacct_add_tsk: fix pure theoretical ->mm use-after-free
From: Oleg Nesterov <oleg@xxxxxxxxxx>
Paranoid fix. The task can free its ->mm after the 'if (p->mm)' check.
Signed-off-by: Oleg Nesterov <oleg@xxxxxxxxxx>
Cc: Shailabh Nagar <nagar@xxxxxxxxxxxxxx>
Cc: Balbir Singh <balbir@xxxxxxxxxx>
Cc: Jay Lan <jlan@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
kernel/tsacct.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff -puN kernel/tsacct.c~xacct_add_tsk-fix-pure-theoretical-mm-use-after-free kernel/tsacct.c
--- a/kernel/tsacct.c~xacct_add_tsk-fix-pure-theoretical-mm-use-after-free
+++ a/kernel/tsacct.c
@@ -80,13 +80,17 @@ void bacct_add_tsk(struct taskstats *sta
*/
void xacct_add_tsk(struct taskstats *stats, struct task_struct *p)
{
+ struct mm_struct *mm;
+
/* convert pages-jiffies to Mbyte-usec */
stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB;
stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB;
- if (p->mm) {
+ mm = get_task_mm(p);
+ if (mm) {
/* adjust to KB unit */
- stats->hiwater_rss = p->mm->hiwater_rss * PAGE_SIZE / KB;
- stats->hiwater_vm = p->mm->hiwater_vm * PAGE_SIZE / KB;
+ stats->hiwater_rss = mm->hiwater_rss * PAGE_SIZE / KB;
+ stats->hiwater_vm = mm->hiwater_vm * PAGE_SIZE / KB;
+ mmput(mm);
}
stats->read_char = p->rchar;
stats->write_char = p->wchar;
_
Patches currently in -mm which might be from oleg@xxxxxxxxxx are
taskstats-fix-sub-threads-accounting.patch
taskstats_exit_alloc-optimize-simplify.patch
tty-signal-tty-locking.patch
do_task_stat-dont-take-tty_mutex.patch
do_acct_process-dont-take-tty_mutex.patch
trivial-make-set_special_pids-static.patch
sys_unshare-remove-a-broken-clone_sighand-code.patch
sys_setpgid-eliminate-unnecessary-do_each_task_pidpidtype_pgid.patch
session_of_pgrp-kill-unnecessary-do_each_task_pidpidtype_pgid.patch
pidhash-temporary-debug-checks.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
