mm: avoid null-pointer deref in sync_mm_rss() (a3a2e76c) · Commits · 戴 / test

- We weren't zeroing p->rss_stat[] at fork() - Consequently sync_mm_rss() was dereferencing tsk->mm for kernel threads and was oopsing. - Make __sync_task_rss_stat() static, too. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=15648 [akpm@linux-foundation.org: remove the BUG_ON(!mm->rss)] Reported-by:

Troels Liebe Bentsen <tlb@rapanden.dk> Signed-off-by:

KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com> "Michael S. Tsirkin" <mst@redhat.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Cc: Rik van Riel <riel@redhat.com> Cc: Minchan Kim <minchan.kim@gmail.com> Signed-off-by:

Andrew Morton <akpm@linux-foundation.org> Signed-off-by:

Linus Torvalds <torvalds@linux-foundation.org>

kernel/exit.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -953,6 +953,7 @@ NORET_TYPE void do_exit(long code)

		acct_update_integrals(tsk);
		/* sync mm's RSS info before statistics gathering */
		if (tsk->mm)
		sync_mm_rss(tsk, tsk->mm);
		group_dead = atomic_dec_and_test(&tsk->signal->live);
		if (group_dead) {

kernel/fork.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1052,6 +1052,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
		p->prev_utime = cputime_zero;
		p->prev_stime = cputime_zero;
		#endif
		#if defined(SPLIT_RSS_COUNTING)
		memset(&p->rss_stat, 0, sizeof(p->rss_stat));
		#endif

		p->default_timer_slack_ns = current->timer_slack_ns;

mm/memory.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -125,13 +125,12 @@ core_initcall(init_zero_pfn);

		#if defined(SPLIT_RSS_COUNTING)

		void __sync_task_rss_stat(struct task_struct task, struct mm_struct mm)
		static void __sync_task_rss_stat(struct task_struct task, struct mm_struct mm)
		{
		int i;

		for (i = 0; i < NR_MM_COUNTERS; i++) {
		if (task->rss_stat.count[i]) {
		BUG_ON(!mm);
		add_mm_counter(mm, i, task->rss_stat.count[i]);
		task->rss_stat.count[i] = 0;
		}

Admin message