1 files changed, 10 insertions, 2 deletions

diff --git a/mm/oom_kill.c b/mm/oom_kill.c
index f0e8cd9edb1a..26ea8636758f 100644
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -647,8 +647,8 @@ static int oom_reaper(void *unused)
 
 static void wake_oom_reaper(struct task_struct *tsk)
 {
-        /* tsk is already queued? */
-        if (tsk == oom_reaper_list || tsk->oom_reaper_list)
+        /* mm is already queued? */
+        if (test_and_set_bit(MMF_OOM_REAP_QUEUED, &tsk->signal->oom_mm->flags))
                 return;
 
         get_task_struct(tsk);
@@ -975,6 +975,13 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
          * still freeing memory.
          */
         read_lock(&tasklist_lock);
+
+        /*
+         * The task 'p' might have already exited before reaching here. The
+         * put_task_struct() will free task_struct 'p' while the loop still try
+         * to access the field of 'p', so, get an extra reference.
+         */
+        get_task_struct(p);
         for_each_thread(p, t) {
                 list_for_each_entry(child, &t->children, sibling) {
                         unsigned int child_points;
@@ -994,6 +1001,7 @@ static void oom_kill_process(struct oom_control *oc, const char *message)
                         }
                 }
         }
+        put_task_struct(p);
         read_unlock(&tasklist_lock);
 
         /*