[PATCH] fill_tgid: fix task_struct leak and possible oops

1. fill_tgid() forgets to do put_task_struct(first).

2. release_task(first) can happen after fill_tgid() drops tasklist_lock,
   it is unsafe to dereference first->signal.

This is a temporary fix, imho the locking should be reworked.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Shailabh Nagar <nagar@watson.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Jay Lan <jlan@sgi.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 9 insertions, 6 deletions

diff --git a/kernel/taskstats.c b/kernel/taskstats.c
index 5d6a8c54ee8..9aeee511a46 100644
--- a/kernel/taskstats.c
+++ b/kernel/taskstats.c
@@ -237,14 +237,17 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
         } else
                 get_task_struct(first);
 
-        /* Start with stats from dead tasks */
-        spin_lock_irqsave(&first->signal->stats_lock, flags);
-        if (first->signal->stats)
-                memcpy(stats, first->signal->stats, sizeof(*stats));
-        spin_unlock_irqrestore(&first->signal->stats_lock, flags);
 
         tsk = first;
         read_lock(&tasklist_lock);
+        /* Start with stats from dead tasks */
+        if (first->signal) {
+                spin_lock_irqsave(&first->signal->stats_lock, flags);
+                if (first->signal->stats)
+                        memcpy(stats, first->signal->stats, sizeof(*stats));
+                spin_unlock_irqrestore(&first->signal->stats_lock, flags);
+        }
+
         do {
                 if (tsk->exit_state == EXIT_ZOMBIE && thread_group_leader(tsk))
                         continue;
@@ -264,7 +267,7 @@ static int fill_tgid(pid_t tgid, struct task_struct *tgidtsk,
          * Accounting subsytems can also add calls here to modify
          * fields of taskstats.
          */
-
+        put_task_struct(first);
         return 0;
 }