1 files changed, 10 insertions, 1 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 21aa7b3001fb..89c74861a3da 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -69,7 +69,7 @@ static void __unhash_process(struct task_struct *p, bool group_dead)
 
                 list_del_rcu(&p->tasks);
                 list_del_init(&p->sibling);
-                __get_cpu_var(process_counts)--;
+                __this_cpu_dec(process_counts);
         }
         list_del_rcu(&p->thread_group);
 }
@@ -914,6 +914,15 @@ NORET_TYPE void do_exit(long code)
         if (unlikely(!tsk->pid))
                 panic("Attempted to kill the idle task!");
 
+        /*
+         * If do_exit is called because this processes oopsed, it's possible
+         * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+         * continuing. Amongst other possible reasons, this is to prevent
+         * mm_release()->clear_child_tid() from writing to a user-controlled
+         * kernel address.
+         */
+        set_fs(USER_DS);
+
         tracehook_report_exit(&code);
 
         validate_creds_for_do_exit(tsk);