2 files changed, 38 insertions, 30 deletions

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 0a3757067631..71e1a523e209 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1323,12 +1323,9 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
                 err = -ESRCH;
                 goto out;
         }
-        mm = get_task_mm(task);
-        rcu_read_unlock();
+        get_task_struct(task);
 
         err = -EINVAL;
-        if (!mm)
-                goto out;
 
         /*
          * Check if this process has the right to modify the specified
@@ -1336,14 +1333,13 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
          * capabilities, superuser privileges or the same
          * userid as the target process.
          */
-        rcu_read_lock();
         tcred = __task_cred(task);
         if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
             cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
             !capable(CAP_SYS_NICE)) {
                 rcu_read_unlock();
                 err = -EPERM;
-                goto out;
+                goto out_put;
         }
         rcu_read_unlock();
 
@@ -1351,26 +1347,36 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
         /* Is the user allowed to access the target nodes? */
         if (!nodes_subset(*new, task_nodes) && !capable(CAP_SYS_NICE)) {
                 err = -EPERM;
-                goto out;
+                goto out_put;
         }
 
         if (!nodes_subset(*new, node_states[N_HIGH_MEMORY])) {
                 err = -EINVAL;
-                goto out;
+                goto out_put;
         }
 
         err = security_task_movememory(task);
         if (err)
-                goto out;
+                goto out_put;
 
-        err = do_migrate_pages(mm, old, new,
-                capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
-out:
+        mm = get_task_mm(task);
+        put_task_struct(task);
         if (mm)
-                mmput(mm);
+                err = do_migrate_pages(mm, old, new,
+                        capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL : MPOL_MF_MOVE);
+        else
+                err = -EINVAL;
+
+        mmput(mm);
+out:
         NODEMASK_SCRATCH_FREE(scratch);
 
         return err;
+
+out_put:
+        put_task_struct(task);
+        goto out;
+
 }
 
 
diff --git a/mm/migrate.c b/mm/migrate.c
index 1503b6b54ecb..51c08a0c6f68 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1174,20 +1174,17 @@ set_status:
  * Migrate an array of page address onto an array of nodes and fill
  * the corresponding array of status.
  */
-static int do_pages_move(struct mm_struct *mm, struct task_struct *task,
+static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
                          unsigned long nr_pages,
                          const void __user * __user *pages,
                          const int __user *nodes,
                          int __user *status, int flags)
 {
         struct page_to_node *pm;
-        nodemask_t task_nodes;
         unsigned long chunk_nr_pages;
         unsigned long chunk_start;
         int err;
 
-        task_nodes = cpuset_mems_allowed(task);
-
         err = -ENOMEM;
         pm = (struct page_to_node *)__get_free_page(GFP_KERNEL);
         if (!pm)
@@ -1349,6 +1346,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
         struct task_struct *task;
         struct mm_struct *mm;
         int err;
+        nodemask_t task_nodes;
 
         /* Check flags */
         if (flags & ~(MPOL_MF_MOVE|MPOL_MF_MOVE_ALL))
@@ -1364,11 +1362,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
                 rcu_read_unlock();
                 return -ESRCH;
         }
-        mm = get_task_mm(task);
-        rcu_read_unlock();
-
-        if (!mm)
-                return -EINVAL;
+        get_task_struct(task);
 
         /*
          * Check if this process has the right to modify the specified
@@ -1376,7 +1370,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
          * capabilities, superuser privileges or the same
          * userid as the target process.
          */
-        rcu_read_lock();
         tcred = __task_cred(task);
         if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
             cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
@@ -1391,16 +1384,25 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
         if (err)
                 goto out;
 
-        if (nodes) {
-                err = do_pages_move(mm, task, nr_pages, pages, nodes, status,
-                                    flags);
-        } else {
-                err = do_pages_stat(mm, nr_pages, pages, status);
-        }
+        task_nodes = cpuset_mems_allowed(task);
+        mm = get_task_mm(task);
+        put_task_struct(task);
+
+        if (mm) {
+                if (nodes)
+                        err = do_pages_move(mm, task_nodes, nr_pages, pages,
+                                            nodes, status, flags);
+                else
+                        err = do_pages_stat(mm, nr_pages, pages, status);
+        } else
+                err = -EINVAL;
 
-out:
         mmput(mm);
         return err;
+
+out:
+        put_task_struct(task);
+        return err;
 }
 
 /*