diff options
author | Oleg Nesterov <oleg@redhat.com> | 2008-11-17 09:39:47 -0500 |
---|---|---|
committer | Ingo Molnar <mingo@elte.hu> | 2008-11-17 10:49:35 -0500 |
commit | ad133ba3dc283300e5b62b5b7211d2f39fbf6ee7 (patch) | |
tree | 4762492d6c564e0ac1ec47122a0d0d49b0d41e90 /kernel/posix-cpu-timers.c | |
parent | 29d7b90c15035741d15421b36000509212b3e135 (diff) |
sched, signals: fix the racy usage of ->signal in account_group_xxx/run_posix_cpu_timers
Impact: fix potential NULL dereference
Contrary to ad474caca3e2a0550b7ce0706527ad5ab389a4d4 changelog, other
acct_group_xxx() helpers can be called after exit_notify() by timer tick.
Thanks to Roland for pointing out this. Somehow I missed this simple fact
when I read the original patch, and I am afraid I confused Frank during
the discussion. Sorry.
Fortunately, these helpers work with current, we can check ->exit_state
to ensure that ->signal can't go away under us.
Also, add the comment and compiler barrier to account_group_exec_runtime(),
to make sure we load ->signal only once.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Diffstat (limited to 'kernel/posix-cpu-timers.c')
-rw-r--r-- | kernel/posix-cpu-timers.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c index 153dcb2639c..895337b16a2 100644 --- a/kernel/posix-cpu-timers.c +++ b/kernel/posix-cpu-timers.c | |||
@@ -1308,9 +1308,10 @@ static inline int task_cputime_expired(const struct task_cputime *sample, | |||
1308 | */ | 1308 | */ |
1309 | static inline int fastpath_timer_check(struct task_struct *tsk) | 1309 | static inline int fastpath_timer_check(struct task_struct *tsk) |
1310 | { | 1310 | { |
1311 | struct signal_struct *sig = tsk->signal; | 1311 | struct signal_struct *sig; |
1312 | 1312 | ||
1313 | if (unlikely(!sig)) | 1313 | /* tsk == current, ensure it is safe to use ->signal/sighand */ |
1314 | if (unlikely(tsk->exit_state)) | ||
1314 | return 0; | 1315 | return 0; |
1315 | 1316 | ||
1316 | if (!task_cputime_zero(&tsk->cputime_expires)) { | 1317 | if (!task_cputime_zero(&tsk->cputime_expires)) { |
@@ -1323,6 +1324,8 @@ static inline int fastpath_timer_check(struct task_struct *tsk) | |||
1323 | if (task_cputime_expired(&task_sample, &tsk->cputime_expires)) | 1324 | if (task_cputime_expired(&task_sample, &tsk->cputime_expires)) |
1324 | return 1; | 1325 | return 1; |
1325 | } | 1326 | } |
1327 | |||
1328 | sig = tsk->signal; | ||
1326 | if (!task_cputime_zero(&sig->cputime_expires)) { | 1329 | if (!task_cputime_zero(&sig->cputime_expires)) { |
1327 | struct task_cputime group_sample; | 1330 | struct task_cputime group_sample; |
1328 | 1331 | ||