Commit d024baa5 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull kthread fix from Thomas Gleixner:
 "A single fix which prevents a use after free when kthread fork fails"

* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  kthread: Fix use-after-free if kthread fork fails
parents 77d64656 4d6501dc
...@@ -1577,6 +1577,18 @@ static __latent_entropy struct task_struct *copy_process( ...@@ -1577,6 +1577,18 @@ static __latent_entropy struct task_struct *copy_process(
if (!p) if (!p)
goto fork_out; goto fork_out;
/*
* This _must_ happen before we call free_task(), i.e. before we jump
* to any of the bad_fork_* labels. This is to avoid freeing
* p->set_child_tid which is (ab)used as a kthread's data pointer for
* kernel threads (PF_KTHREAD).
*/
p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
/*
* Clear TID on mm_release()?
*/
p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
ftrace_graph_init_task(p); ftrace_graph_init_task(p);
rt_mutex_init_task(p); rt_mutex_init_task(p);
...@@ -1743,11 +1755,6 @@ static __latent_entropy struct task_struct *copy_process( ...@@ -1743,11 +1755,6 @@ static __latent_entropy struct task_struct *copy_process(
} }
} }
p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
/*
* Clear TID on mm_release()?
*/
p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
#ifdef CONFIG_BLOCK #ifdef CONFIG_BLOCK
p->plug = NULL; p->plug = NULL;
#endif #endif
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment