Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PATCH] fill_tgid: fix task_struct leak and possible oops

Browse source 
1. fill_tgid() forgets to do put_task_struct(first).

2. release_task(first) can happen after fill_tgid() drops tasklist_lock,
   it is unsafe to dereference first->signal.

This is a temporary fix, imho the locking should be reworked.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Shailabh Nagar <nagar@watson.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Jay Lan <jlan@sgi.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Oleg Nesterov 2006-10-28 10:38:49 -07:00 committed by Linus Torvalds
parent 6e6d9fa6f9
commit fca178c0c6
1 changed files with 9 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
kernel/taskstats.c
View file

@ -237,14 +237,17 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
} else
get_task_struct(first);
/* Start with stats from dead tasks */
spin_lock_irqsave(&first->signal->stats_lock, flags);
if (first->signal->stats)
memcpy(stats, first->signal->stats, sizeof(*stats));
spin_unlock_irqrestore(&first->signal->stats_lock, flags);
tsk = first;
read_lock(&tasklist_lock);
/* Start with stats from dead tasks */
if (first->signal) {
spin_lock_irqsave(&first->signal->stats_lock, flags);
if (first->signal->stats)
memcpy(stats, first->signal->stats, sizeof(*stats));
spin_unlock_irqrestore(&first->signal->stats_lock, flags);
}
do {
if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
continue;
@ -264,7 +267,7 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
* Accounting subsytems can also add calls here to modify
* fields of taskstats.
*/
put_task_struct(first);
return 0;
}