summaryrefslogtreecommitdiff
path: root/include/linux
diff options
context:
space:
mode:
authorKOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>2008-05-12 14:02:31 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2008-05-13 08:02:25 -0700
commit4cd1a8fc3d3cd740416b14ece2693dbb5d065eaf (patch)
tree2acebe40e15b91a3df78ea5b677a84c509a30ae0 /include/linux
parentc9bfcb3151040cff6714542d1da04ccd7e2d3efc (diff)
memcg: fix possible panic when CONFIG_MM_OWNER=y
When mm destruction happens, we should pass mm_update_next_owner() the old mm. But unfortunately new mm is passed in exec_mmap(). Thus, kernel panic is possible when a multi-threaded process uses exec(). Also, the owner member comment description is wrong. mm->owner does not necessarily point to the thread group leader. [akpm@linux-foundation.org: coding-style fixes] Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com> Acked-by: Balbir Singh <balbir@linux.vnet.ibm.com> Cc: "Paul Menage" <menage@google.com> Cc: "KAMEZAWA Hiroyuki" <kamezawa.hiroyu@jp.fujitsu.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'include/linux')
-rw-r--r--include/linux/mm_types.h13
1 files changed, 11 insertions, 2 deletions
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index eb7c16cc9559..02a27ae78539 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -226,8 +226,17 @@ struct mm_struct {
rwlock_t ioctx_list_lock; /* aio lock */
struct kioctx *ioctx_list;
#ifdef CONFIG_MM_OWNER
- struct task_struct *owner; /* The thread group leader that */
- /* owns the mm_struct. */
+ /*
+ * "owner" points to a task that is regarded as the canonical
+ * user/owner of this mm. All of the following must be true in
+ * order for it to be changed:
+ *
+ * current == mm->owner
+ * current->mm != mm
+ * new_owner->mm == mm
+ * new_owner->alloc_lock is held
+ */
+ struct task_struct *owner;
#endif
#ifdef CONFIG_PROC_FS