Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
[PATCH] xacct_add_tsk: fix pure theoretical ->mm use-after-free
Paranoid fix. The task can free its ->mm after the 'if (p->mm)' check.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Shailabh Nagar <nagar@watson.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Jay Lan <jlan@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
authored by Oleg Nesterov and committed by Linus Torvalds f0ec1aaf d45e44d4
+7
-3
kernel/tsacct.c
+7
-3
kernel/tsacct.c
···
80
*/
81
void xacct_add_tsk(struct taskstats *stats, struct task_struct *p)
82
{
83
/* convert pages-jiffies to Mbyte-usec */
84
stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB;
85
stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB;
86
-
if (p->mm) {
87
/* adjust to KB unit */
88
-
stats->hiwater_rss = p->mm->hiwater_rss * PAGE_SIZE / KB;
89
-
stats->hiwater_vm = p->mm->hiwater_vm * PAGE_SIZE / KB;
90
}
91
stats->read_char = p->rchar;
92
stats->write_char = p->wchar;
···
80
*/
81
void xacct_add_tsk(struct taskstats *stats, struct task_struct *p)
82
{
83
+
struct mm_struct *mm;
84
+
85
/* convert pages-jiffies to Mbyte-usec */
86
stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB;
87
stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB;
88
+
mm = get_task_mm(p);
89
+
if (mm) {
90
/* adjust to KB unit */
91
+
stats->hiwater_rss = mm->hiwater_rss * PAGE_SIZE / KB;
92
+
stats->hiwater_vm = mm->hiwater_vm * PAGE_SIZE / KB;
93
+
mmput(mm);
94
}
95
stats->read_char = p->rchar;
96
stats->write_char = p->wchar;