1 files changed, 4 insertions, 5 deletions

diff --git a/kernel/exit.c b/kernel/exit.c
index 85a83c831856..0ef4673e351b 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -640,24 +640,23 @@ retry:
 assign_new_owner:
         BUG_ON(c == p);
         get_task_struct(c);
+        read_unlock(&tasklist_lock);
+        down_write(&mm->mmap_sem);
         /*
          * The task_lock protects c->mm from changing.
          * We always want mm->owner->mm == mm
          */
         task_lock(c);
-        /*
-         * Delay read_unlock() till we have the task_lock()
-         * to ensure that c does not slip away underneath us
-         */
-        read_unlock(&tasklist_lock);
         if (c->mm != mm) {
                 task_unlock(c);
+                up_write(&mm->mmap_sem);
                 put_task_struct(c);
                 goto retry;
         }
         cgroup_mm_owner_callbacks(mm->owner, c);
         mm->owner = c;
         task_unlock(c);
+        up_write(&mm->mmap_sem);
         put_task_struct(c);
 }
 #endif /* CONFIG_MM_OWNER */