提交 4cd1a8fc 编写于 作者: K KOSAKI Motohiro 提交者: Linus Torvalds

memcg: fix possible panic when CONFIG_MM_OWNER=y

When mm destruction happens, we should pass mm_update_next_owner() the old mm.
 But unfortunately new mm is passed in exec_mmap().

Thus, kernel panic is possible when a multi-threaded process uses exec().

Also, the owner member comment description is wrong.  mm->owner does not
necessarily point to the thread group leader.

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: NKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: NBalbir Singh <balbir@linux.vnet.ibm.com>
Cc: "Paul Menage" <menage@google.com>
Cc: "KAMEZAWA Hiroyuki" <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 c9bfcb31
...@@ -736,7 +736,7 @@ static int exec_mmap(struct mm_struct *mm) ...@@ -736,7 +736,7 @@ static int exec_mmap(struct mm_struct *mm)
tsk->active_mm = mm; tsk->active_mm = mm;
activate_mm(active_mm, mm); activate_mm(active_mm, mm);
task_unlock(tsk); task_unlock(tsk);
mm_update_next_owner(mm); mm_update_next_owner(old_mm);
arch_pick_mmap_layout(mm); arch_pick_mmap_layout(mm);
if (old_mm) { if (old_mm) {
up_read(&old_mm->mmap_sem); up_read(&old_mm->mmap_sem);
......
...@@ -226,8 +226,17 @@ struct mm_struct { ...@@ -226,8 +226,17 @@ struct mm_struct {
rwlock_t ioctx_list_lock; /* aio lock */ rwlock_t ioctx_list_lock; /* aio lock */
struct kioctx *ioctx_list; struct kioctx *ioctx_list;
#ifdef CONFIG_MM_OWNER #ifdef CONFIG_MM_OWNER
struct task_struct *owner; /* The thread group leader that */ /*
/* owns the mm_struct. */ * "owner" points to a task that is regarded as the canonical
* user/owner of this mm. All of the following must be true in
* order for it to be changed:
*
* current == mm->owner
* current->mm != mm
* new_owner->mm == mm
* new_owner->alloc_lock is held
*/
struct task_struct *owner;
#endif #endif
#ifdef CONFIG_PROC_FS #ifdef CONFIG_PROC_FS
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册