2 files changed, 12 insertions, 3 deletions

diff --git a/fs/exec.c b/fs/exec.c
index aeaa9791d8be..1f8a24aa1f8b 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -736,7 +736,7 @@ static int exec_mmap(struct mm_struct *mm)
         tsk->active_mm = mm;
         activate_mm(active_mm, mm);
         task_unlock(tsk);
-        mm_update_next_owner(mm);
+        mm_update_next_owner(old_mm);
         arch_pick_mmap_layout(mm);
         if (old_mm) {
                 up_read(&old_mm->mmap_sem);
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index eb7c16cc9559..02a27ae78539 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -226,8 +226,17 @@ struct mm_struct {
         rwlock_t                ioctx_list_lock;        /* aio lock */
         struct kioctx           *ioctx_list;
 #ifdef CONFIG_MM_OWNER
-        struct task_struct *owner;      /* The thread group leader that */
-                                        /* owns the mm_struct.          */
+        /*
+         * "owner" points to a task that is regarded as the canonical
+         * user/owner of this mm. All of the following must be true in
+         * order for it to be changed:
+         *
+         * current == mm->owner
+         * current->mm != mm
+         * new_owner->mm == mm
+         * new_owner->alloc_lock is held
+         */
+        struct task_struct *owner;
 #endif
 
 #ifdef CONFIG_PROC_FS