Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d024baa5 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 

Pull kthread fix from Thomas Gleixner:
 "A single fix which prevents a use after free when kthread fork fails"

* 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  kthread: Fix use-after-free if kthread fork fails
parents 77d64656 4d6501dc

kernel/fork.c

+12 −5
Original line number Diff line number Diff line
@@ -1577,6 +1577,18 @@ static __latent_entropy struct task_struct *copy_process( 
	if (!p)

		goto fork_out;



	/*

	 * This _must_ happen before we call free_task(), i.e. before we jump

	 * to any of the bad_fork_* labels. This is to avoid freeing

	 * p->set_child_tid which is (ab)used as a kthread's data pointer for

	 * kernel threads (PF_KTHREAD).

	 */

	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;

	/*

	 * Clear TID on mm_release()?

	 */

	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;



	ftrace_graph_init_task(p);



	rt_mutex_init_task(p);
@@ -1743,11 +1755,6 @@ static __latent_entropy struct task_struct *copy_process( 
		}

	}



	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;

	/*

	 * Clear TID on mm_release()?

	 */

	p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;

#ifdef CONFIG_BLOCK

	p->plug = NULL;

#endif