[PATCH] fill_tgid: fix task_struct leak and possible oops
1. fill_tgid() forgets to do put_task_struct(first). 2. release_task(first) can happen after fill_tgid() drops tasklist_lock, it is unsafe to dereference first->signal. This is a temporary fix, imho the locking should be reworked. Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Cc: Shailabh Nagar <nagar@watson.ibm.com> Cc: Balbir Singh <balbir@in.ibm.com> Cc: Jay Lan <jlan@sgi.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
6e6d9fa6f9
commit
fca178c0c6
|
@ -237,14 +237,17 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
|
|||
} else
|
||||
get_task_struct(first);
|
||||
|
||||
/* Start with stats from dead tasks */
|
||||
spin_lock_irqsave(&first->signal->stats_lock, flags);
|
||||
if (first->signal->stats)
|
||||
memcpy(stats, first->signal->stats, sizeof(*stats));
|
||||
spin_unlock_irqrestore(&first->signal->stats_lock, flags);
|
||||
|
||||
tsk = first;
|
||||
read_lock(&tasklist_lock);
|
||||
/* Start with stats from dead tasks */
|
||||
if (first->signal) {
|
||||
spin_lock_irqsave(&first->signal->stats_lock, flags);
|
||||
if (first->signal->stats)
|
||||
memcpy(stats, first->signal->stats, sizeof(*stats));
|
||||
spin_unlock_irqrestore(&first->signal->stats_lock, flags);
|
||||
}
|
||||
|
||||
do {
|
||||
if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
|
||||
continue;
|
||||
|
@ -264,7 +267,7 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
|
|||
* Accounting subsytems can also add calls here to modify
|
||||
* fields of taskstats.
|
||||
*/
|
||||
|
||||
put_task_struct(first);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue