[PATCH 1/6] fill_tgid: fix task_struct leak and possible oops

Oleg Nesterov
2006-10-26T23:21:09Z

1. fill_tgid() forgets to do put_task_struct(first).

2. release_task(first) can happen after fill_tgid() drops tasklist_lock,
it is unsafe to dereference first->signal.

This is a temporary fix, imho the locking should be reworked.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>

--- STATS/kernel/taskstats.c~1_fix_sig 2006-10-22 18:24:03.000000000 +0400
+++ STATS/kernel/taskstats.c 2006-10-26 23:44:32.000000000 +0400
@@ -237,14 +237,17 @@ static int fill_tgid(pid_t tgid, struct
} else
get_task_struct(first);

- /* Start with stats from dead tasks */
- spin_lock_irqsave(&first->signal->stats_lock, flags);
- if (first->signal->stats)
- memcpy(stats, first->signal->stats, sizeof(*stats));
- spin_unlock_irqrestore(&first->signal->stats_lock, flags);

tsk = first;
read_lock(&tasklist_lock);
+ /* Start with stats from dead tasks */
+ if (first->signal) {
+ spin_lock_irqsave(&first->signal->stats_lock, flags);
+ if (first->signal->stats)
+ memcpy(stats, first->signal->stats, sizeof(*stats));
+ spin_unlock_irqrestore(&first->signal->stats_lock, flags);
+ }
+
do {
if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
continue;
@@ -264,7 +267,7 @@ static int fill_tgid(pid_t tgid, struct
* Accounting subsytems can also add calls here to modify
* fields of taskstats.
*/
-
+ put_task_struct(first);
return 0;
}