1 files changed, 13 insertions, 1 deletions

diff --git a/fs/proc/base.c b/fs/proc/base.c
index be1909041685..d9512bd03e6c 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -711,6 +711,13 @@ static int mem_open(struct inode* inode, struct file* file)
         if (IS_ERR(mm))
                 return PTR_ERR(mm);
 
+        if (mm) {
+                /* ensure this mm_struct can't be freed */
+                atomic_inc(&mm->mm_count);
+                /* but do not pin its memory */
+                mmput(mm);
+        }
+
         /* OK to pass negative loff_t, we can catch out-of-range */
         file->f_mode |= FMODE_UNSIGNED_OFFSET;
         file->private_data = mm;
@@ -734,6 +741,9 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
                 return -ENOMEM;
 
         copied = 0;
+        if (!atomic_inc_not_zero(&mm->mm_users))
+                goto free;
+
         while (count > 0) {
                 int this_len = min_t(int, count, PAGE_SIZE);
 
@@ -761,6 +771,8 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
         }
         *ppos = addr;
 
+        mmput(mm);
+free:
         free_page((unsigned long) page);
         return copied;
 }
@@ -797,7 +809,7 @@ static int mem_release(struct inode *inode, struct file *file)
 {
         struct mm_struct *mm = file->private_data;
         if (mm)
-                mmput(mm);
+                mmdrop(mm);
         return 0;
 }