[PATCH] proc_pid_status() oops fix

proc_pid_status dereferences pointers in the task structure even if the
task is already dead.  This is probably the reason for the oops described
in

http://bugme.osdl.org/show_bug.cgi?id=3812

The attached patch removes the pointer dereferences by using pid_alive()
for testing that the task structure contents is still valid before
dereferencing them.  The task structure itself is guaranteed to be valid -
we hold a reference count.

Signed-Off-By: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/proc/array.c b/fs/proc/array.c
index 6db46cb190c5d711ed00af23825f9443347cea4f..f5ad3980b0ff3f3f076e66df87407db79678f9c9 100644 (file)
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -171,8 +171,8 @@ static inline char * task_state(struct task_struct *p, char *buffer)
                get_task_state(p),
                (p->sleep_avg/1024)*100/(1020000000/1024),
                p->tgid,
-               p->pid, p->pid ? p->group_leader->real_parent->tgid : 0,
-               p->pid && p->ptrace ? p->parent->pid : 0,
+               p->pid, pid_alive(p) ? p->group_leader->real_parent->tgid : 0,
+               pid_alive(p) && p->ptrace ? p->parent->pid : 0,
                p->uid, p->euid, p->suid, p->fsuid,
                p->gid, p->egid, p->sgid, p->fsgid);
        read_unlock(&tasklist_lock);

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 7acfee6ece8d4f953c641d1474aea48a654975e8..d6fb25eeee7a51363ee97c0f1eb392898d8af151 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -780,11 +780,6 @@ static struct inode_operations proc_pid_link_inode_operations = {
        .follow_link    = proc_pid_follow_link
 };
 
-static inline int pid_alive(struct task_struct *p)
-{
-       return p->pids[PIDTYPE_PID].nr != 0;
-}
-
 #define NUMBUF 10
 
 static int proc_readfd(struct file * filp, void * dirent, filldir_t filldir)

diff --git a/include/linux/sched.h b/include/linux/sched.h
index 0c8262c6d6b8c5202f7ecf67f50e7a4704287a40..440393fcd5c75dec14cb77686d9f775b7cde3e94 100644 (file)
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -671,6 +671,19 @@ static inline pid_t process_group(struct task_struct *tsk)
        return tsk->signal->pgrp;
 }
 
+/**
+ * pid_alive - check that a task structure is not stale
+ * @p: Task structure to be checked.
+ *
+ * Test if a process is not yet dead (at most zombie state)
+ * If pid_alive fails, then pointers within the task structure
+ * can be stale and must not be dereferenced.
+ */
+static inline int pid_alive(struct task_struct *p)
+{
+       return p->pids[PIDTYPE_PID].nr != 0;
+}
+
 extern void free_task(struct task_struct *tsk);
 extern void __put_task_struct(struct task_struct *tsk);
 #define get_task_struct(tsk) do { atomic_inc(&(tsk)->usage); } while(0)