aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@tv-sign.ru>2006-10-28 10:38:49 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2006-10-28 11:30:54 -0700
commitfca178c0c6e8d52a1875be36b070f30884ebfae9 (patch)
tree4bce17647edd3fae6b0ba96407cd1c02037b11d1
parent6e6d9fa6f95e382bb2d5725dda18b9e811418e79 (diff)
[PATCH] fill_tgid: fix task_struct leak and possible oops
1. fill_tgid() forgets to do put_task_struct(first). 2. release_task(first) can happen after fill_tgid() drops tasklist_lock, it is unsafe to dereference first->signal. This is a temporary fix, imho the locking should be reworked. Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru> Cc: Shailabh Nagar <nagar@watson.ibm.com> Cc: Balbir Singh <balbir@in.ibm.com> Cc: Jay Lan <jlan@sgi.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--kernel/taskstats.c15
1 files changed, 9 insertions, 6 deletions
diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 5d6a8c54ee8..9aeee511a46 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -237,14 +237,17 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
} else
get_task_struct(first);
- /* Start with stats from dead tasks */
- spin_lock_irqsave(&first->signal->stats_lock, flags);
- if (first->signal->stats)
- memcpy(stats, first->signal->stats, sizeof(*stats));
- spin_unlock_irqrestore(&first->signal->stats_lock, flags);
tsk = first;
read_lock(&tasklist_lock);
+ /* Start with stats from dead tasks */
+ if (first->signal) {
+ spin_lock_irqsave(&first->signal->stats_lock, flags);
+ if (first->signal->stats)
+ memcpy(stats, first->signal->stats, sizeof(*stats));
+ spin_unlock_irqrestore(&first->signal->stats_lock, flags);
+ }
+
do {
if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
continue;
@@ -264,7 +267,7 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
* Accounting subsytems can also add calls here to modify
* fields of taskstats.
*/
-
+ put_task_struct(first);
return 0;
}