From: Oleg Nesterov <oleg@tv-sign.ru>
To: Andrew Morton <akpm@osdl.org>
Cc: Shailabh Nagar <nagar@watson.ibm.com>,
Balbir Singh <balbir@in.ibm.com>, Jay Lan <jlan@sgi.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH] xacct_add_tsk: fix pure theoretical ->mm use-after-free
Date: Sun, 29 Oct 2006 21:58:26 +0300 [thread overview]
Message-ID: <20061029185826.GA1619@oleg> (raw)
Paranoid fix. The task can free its ->mm after the 'if (p->mm)' check.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
--- STATS/kernel/tsacct.c~3_mm 2006-10-27 01:03:26.000000000 +0400
+++ STATS/kernel/tsacct.c 2006-10-29 21:46:12.000000000 +0300
@@ -80,13 +80,17 @@ void bacct_add_tsk(struct taskstats *sta
*/
void xacct_add_tsk(struct taskstats *stats, struct task_struct *p)
{
+ struct mm_struct *mm;
+
/* convert pages-jiffies to Mbyte-usec */
stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB;
stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB;
- if (p->mm) {
+ mm = get_task_mm(p);
+ if (mm) {
/* adjust to KB unit */
- stats->hiwater_rss = p->mm->hiwater_rss * PAGE_SIZE / KB;
- stats->hiwater_vm = p->mm->hiwater_vm * PAGE_SIZE / KB;
+ stats->hiwater_rss = mm->hiwater_rss * PAGE_SIZE / KB;
+ stats->hiwater_vm = mm->hiwater_vm * PAGE_SIZE / KB;
+ mmput(mm);
}
stats->read_char = p->rchar;
stats->write_char = p->wchar;
next reply other threads:[~2006-10-29 17:58 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-10-29 18:58 Oleg Nesterov [this message]
2006-10-30 18:51 ` [PATCH] xacct_add_tsk: fix pure theoretical ->mm use-after-free Jay Lan
2006-10-30 20:41 ` Oleg Nesterov
2006-10-31 3:08 ` Jay Lan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20061029185826.GA1619@oleg \
--to=oleg@tv-sign.ru \
--cc=akpm@osdl.org \
--cc=balbir@in.ibm.com \
--cc=jlan@sgi.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nagar@watson.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox