projects/linux·commit 4cd1a8fc

memcg: fix possible panic when CONFIG_MM_OWNER=y

4cd1a8fc · KOSAKI Motohiro <[email protected]> · 2008-05-12 14:02:31 -07:00

When mm destruction happens, we should pass mm_update_next_owner() the old mm.
 But unfortunately new mm is passed in exec_mmap().

Thus, kernel panic is possible when a multi-threaded process uses exec().

Also, the owner member comment description is wrong.  mm->owner does not
necessarily point to the thread group leader.

[[email protected]: coding-style fixes]
Signed-off-by: KOSAKI Motohiro <[email protected]>
Acked-by: Balbir Singh <[email protected]>
Cc: "Paul Menage" <[email protected]>
Cc: "KAMEZAWA Hiroyuki" <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Commit
4cd1a8fc3d3cd740416b14ece2693dbb5d065eaf
Parents
c9bfcb31

Changes

2 files changed · +12 −3

FileStatusAddDelContent
fs/exec.cmodified+1−1View file
include/linux/mm_types.hmodified+11−2View file

fs/exec.c

View file
diff --git a/fs/exec.c b/fs/exec.c
index aeaa979..1f8a24a 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -736,7 +736,7 @@ static int exec_mmap(struct mm_struct *mm)
tsk->active_mm = mm;
activate_mm(active_mm, mm);
task_unlock(tsk);
- mm_update_next_owner(mm);
+ mm_update_next_owner(old_mm);
arch_pick_mmap_layout(mm);
if (old_mm) {
up_read(&old_mm->mmap_sem);

include/linux/mm_types.h

View file
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index eb7c16c..02a27ae 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -226,8 +226,17 @@ struct mm_struct {
rwlock_t ioctx_list_lock; /* aio lock */
struct kioctx *ioctx_list;
#ifdef CONFIG_MM_OWNER
- struct task_struct *owner; /* The thread group leader that */
- /* owns the mm_struct. */
+ /*
+ * "owner" points to a task that is regarded as the canonical
+ * user/owner of this mm. All of the following must be true in
+ * order for it to be changed:
+ *
+ * current == mm->owner
+ * current->mm != mm
+ * new_owner->mm == mm
+ * new_owner->alloc_lock is held
+ */
+ struct task_struct *owner;
#endif
#ifdef CONFIG_PROC_FS