Re: free_task_struct() called too early?

[Andrew Morton <akpm@zip.com.au>]

"Chen, Kenneth W" wrote:
> 
> When a process terminates, it appears that the task structure is freed too
> early.  There are memory references to the kernel task area (task_struct and
> stack space) after free_task_struct(p) is called.
> 
> If I modify the following line in include/asm-i386/processor.h
> 
> #define free_task_struct(p)   free_pages((unsigned long) (p), 1) to
> #define free_task_struct(p)   memset((void*) (p), 0xf, PAGE_SIZE*2);
> free_pages((unsigned long) (p), 1)
> then kernel will boot to init and lockup on when first task terminates.

free_pages will not actually free the page if its reference count
is greater than one - you're poisoning the page before it has actually
ceased to be used.

You should zap the page in __free_pages(), after the put_page_testzero()
call has succeeded.