fs/proc/task_nommu.c: don't use priv->task->mm

I do not know if CONFIG_PREEMPT/SMP is possible without CONFIG_MMU
but the usage of task->mm in m_stop(). The task can exit/exec before
we take mmap_sem, in this case m_stop() can hit NULL or unlock the
wrong rw_semaphore.

Also, this code uses priv->task != NULL to decide whether we need
up_read/mmput. This is correct, but we will probably kill priv->task.
Change m_start/m_stop to rely on IS_ERR_OR_NULL() like task_mmu.c does.

Signed-off-by: Oleg Nesterov <[email protected]>
Cc: Kirill A. Shutemov <[email protected]>
Cc: Cyrill Gorcunov <[email protected]>
Cc: "Eric W. Biederman" <[email protected]>
Acked-by: Greg Ungerer <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index 9019f1de3f7245997ddb8e0c5ec23b1ad5236e9b..429cb7a5419ec6e7491b17f0fdc4ad69fb34d9da 100644 (file)
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -217,17 +217,17 @@ static void *m_start(struct seq_file *m, loff_t *pos)
                return ERR_PTR(-ESRCH);
 
        mm = priv->mm;
-       if (!mm || !atomic_inc_not_zero(&mm->mm_users)) {
-               put_task_struct(priv->task);
-               priv->task = NULL;
+       if (!mm || !atomic_inc_not_zero(&mm->mm_users))
                return NULL;
-       }
-       down_read(&mm->mmap_sem);
 
+       down_read(&mm->mmap_sem);
        /* start from the Nth VMA */
        for (p = rb_first(&mm->mm_rb); p; p = rb_next(p))
                if (n-- == 0)
                        return p;
+
+       up_read(&mm->mmap_sem);
+       mmput(mm);
        return NULL;
 }
 
@@ -235,11 +235,13 @@ static void m_stop(struct seq_file *m, void *_vml)
 {
        struct proc_maps_private *priv = m->private;
 
+       if (!IS_ERR_OR_NULL(_vml)) {
+               up_read(&priv->mm->mmap_sem);
+               mmput(priv->mm);
+       }
        if (priv->task) {
-               struct mm_struct *mm = priv->task->mm;
-               up_read(&mm->mmap_sem);
-               mmput(mm);
                put_task_struct(priv->task);
+               priv->task = NULL;
        }
 }