[PATCH] vt: fix possible memory corruption in complement_pos

[linux-2.6] / kernel / exit.c

diff --git a/kernel/exit.c b/kernel/exit.c
index c2bdf6fb61a57e10855e2d6092a0d3473438d8c3..5b0fb9f09f212d05642dd343be2692a2b0a039b7 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -72,6 +72,11 @@ repeat:
        BUG_ON(!list_empty(&p->ptrace_list) || !list_empty(&p->ptrace_children));
        __exit_signal(p);
        __exit_sighand(p);
+       /*
+        * Note that the fastpath in sys_times depends on __exit_signal having
+        * updated the counters before a task is removed from the tasklist of
+        * the process by __unhash_process.
+        */
        __unhash_process(p);
 
        /*
@@ -779,6 +784,8 @@ fastcall NORET_TYPE void do_exit(long code)
 
        profile_task_exit(tsk);
 
+       WARN_ON(atomic_read(&tsk->fs_excl));
+
        if (unlikely(in_interrupt()))
                panic("Aiee, killing interrupt handler!");
        if (unlikely(!tsk->pid))
@@ -822,8 +829,10 @@ fastcall NORET_TYPE void do_exit(long code)
        acct_update_integrals(tsk);
        update_mem_hiwater(tsk);
        group_dead = atomic_dec_and_test(&tsk->signal->live);
-       if (group_dead)
+       if (group_dead) {
+               del_timer_sync(&tsk->signal->real_timer);
                acct_process(code);
+       }
        exit_mm(tsk);
 
        exit_sem(tsk);