Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 11cad320 authored by Vitaliy Gusev's avatar Vitaliy Gusev Committed by Linus Torvalds
Browse files

bsdacct: use del_timer_sync() in acct_exit_ns() 



acct_exit_ns --> acct_file_reopen deletes timer without check timer
execution on other CPUs.  So acct_timeout() can change an unmapped memory.

Signed-off-by: default avatarVitaliy Gusev <vgusev@openvz.org>
Cc: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent ab941e0f

kernel/acct.c

+9 −8
Original line number Diff line number Diff line
@@ -353,18 +353,19 @@ void acct_auto_close(struct super_block *sb) 


void acct_exit_ns(struct pid_namespace *ns)

{

	struct bsd_acct_struct *acct;

	struct bsd_acct_struct *acct = ns->bacct;



	if (acct == NULL)

		return;



	del_timer_sync(&acct->timer);

	spin_lock(&acct_lock);

	acct = ns->bacct;

	if (acct != NULL) {

	if (acct->file != NULL)

		acct_file_reopen(acct, NULL, NULL);

	spin_unlock(&acct_lock);



	kfree(acct);

}

	spin_unlock(&acct_lock);

}



/*

 *  encode an unsigned long into a comp_t