diff options
| author | KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> | 2008-05-12 14:02:31 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2008-05-13 08:02:25 -0700 |
| commit | 4cd1a8fc3d3cd740416b14ece2693dbb5d065eaf (patch) | |
| tree | 2acebe40e15b91a3df78ea5b677a84c509a30ae0 /include/linux | |
| parent | c9bfcb3151040cff6714542d1da04ccd7e2d3efc (diff) | |
| download | op-kernel-dev-4cd1a8fc3d3cd740416b14ece2693dbb5d065eaf.zip op-kernel-dev-4cd1a8fc3d3cd740416b14ece2693dbb5d065eaf.tar.gz | |
memcg: fix possible panic when CONFIG_MM_OWNER=y
When mm destruction happens, we should pass mm_update_next_owner() the old mm.
But unfortunately new mm is passed in exec_mmap().
Thus, kernel panic is possible when a multi-threaded process uses exec().
Also, the owner member comment description is wrong. mm->owner does not
necessarily point to the thread group leader.
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Acked-by: Balbir Singh <balbir@linux.vnet.ibm.com>
Cc: "Paul Menage" <menage@google.com>
Cc: "KAMEZAWA Hiroyuki" <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux')
| -rw-r--r-- | include/linux/mm_types.h | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index eb7c16c..02a27ae 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -226,8 +226,17 @@ struct mm_struct { rwlock_t ioctx_list_lock; /* aio lock */ struct kioctx *ioctx_list; #ifdef CONFIG_MM_OWNER - struct task_struct *owner; /* The thread group leader that */ - /* owns the mm_struct. */ + /* + * "owner" points to a task that is regarded as the canonical + * user/owner of this mm. All of the following must be true in + * order for it to be changed: + * + * current == mm->owner + * current->mm != mm + * new_owner->mm == mm + * new_owner->alloc_lock is held + */ + struct task_struct *owner; #endif #ifdef CONFIG_PROC_FS |
