[PATCH] fs/smbfs/request.c: turn NULL dereference into BUG()
[safe/jmp/linux-2.6] / kernel / exit.c
index 2ef2ad5..452a1d1 100644 (file)
@@ -28,6 +28,7 @@
 #include <linux/cpuset.h>
 #include <linux/syscalls.h>
 #include <linux/signal.h>
+#include <linux/cn_proc.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -72,6 +73,11 @@ repeat:
        BUG_ON(!list_empty(&p->ptrace_list) || !list_empty(&p->ptrace_children));
        __exit_signal(p);
        __exit_sighand(p);
+       /*
+        * Note that the fastpath in sys_times depends on __exit_signal having
+        * updated the counters before a task is removed from the tasklist of
+        * the process by __unhash_process.
+        */
        __unhash_process(p);
 
        /*
@@ -363,17 +369,25 @@ EXPORT_SYMBOL(daemonize);
 static inline void close_files(struct files_struct * files)
 {
        int i, j;
+       struct fdtable *fdt;
 
        j = 0;
+
+       /*
+        * It is safe to dereference the fd table without RCU or
+        * ->file_lock because this is the last reference to the
+        * files structure.
+        */
+       fdt = files_fdtable(files);
        for (;;) {
                unsigned long set;
                i = j * __NFDBITS;
-               if (i >= files->max_fdset || i >= files->max_fds)
+               if (i >= fdt->max_fdset || i >= fdt->max_fds)
                        break;
-               set = files->open_fds->fds_bits[j++];
+               set = fdt->open_fds->fds_bits[j++];
                while (set) {
                        if (set & 1) {
-                               struct file * file = xchg(&files->fd[i], NULL);
+                               struct file * file = xchg(&fdt->fd[i], NULL);
                                if (file)
                                        filp_close(file, files);
                        }
@@ -398,18 +412,22 @@ struct files_struct *get_files_struct(struct task_struct *task)
 
 void fastcall put_files_struct(struct files_struct *files)
 {
+       struct fdtable *fdt;
+
        if (atomic_dec_and_test(&files->count)) {
                close_files(files);
                /*
                 * Free the fd and fdset arrays if we expanded them.
+                * If the fdtable was embedded, pass files for freeing
+                * at the end of the RCU grace period. Otherwise,
+                * you can free files immediately.
                 */
-               if (files->fd != &files->fd_array[0])
-                       free_fd_array(files->fd, files->max_fds);
-               if (files->max_fdset > __FD_SETSIZE) {
-                       free_fdset(files->open_fds, files->max_fdset);
-                       free_fdset(files->close_on_exec, files->max_fdset);
-               }
-               kmem_cache_free(files_cachep, files);
+               fdt = files_fdtable(files);
+               if (fdt == &files->fdtab)
+                       fdt->free_files = files;
+               else
+                       kmem_cache_free(files_cachep, files);
+               free_fdtable(fdt);
        }
 }
 
@@ -530,7 +548,7 @@ static inline void reparent_thread(task_t *p, task_t *father, int traced)
 
        if (p->pdeath_signal)
                /* We already hold the tasklist_lock here.  */
-               group_send_sig_info(p->pdeath_signal, (void *) 0, p);
+               group_send_sig_info(p->pdeath_signal, SEND_SIG_NOINFO, p);
 
        /* Move the child from its dying parent to the new one.  */
        if (unlikely(traced)) {
@@ -574,8 +592,8 @@ static inline void reparent_thread(task_t *p, task_t *father, int traced)
                int pgrp = process_group(p);
 
                if (will_become_orphaned_pgrp(pgrp, NULL) && has_stopped_jobs(pgrp)) {
-                       __kill_pg_info(SIGHUP, (void *)1, pgrp);
-                       __kill_pg_info(SIGCONT, (void *)1, pgrp);
+                       __kill_pg_info(SIGHUP, SEND_SIG_PRIV, pgrp);
+                       __kill_pg_info(SIGCONT, SEND_SIG_PRIV, pgrp);
                }
        }
 }
@@ -710,8 +728,8 @@ static void exit_notify(struct task_struct *tsk)
            (t->signal->session == tsk->signal->session) &&
            will_become_orphaned_pgrp(process_group(tsk), tsk) &&
            has_stopped_jobs(process_group(tsk))) {
-               __kill_pg_info(SIGHUP, (void *)1, process_group(tsk));
-               __kill_pg_info(SIGCONT, (void *)1, process_group(tsk));
+               __kill_pg_info(SIGHUP, SEND_SIG_PRIV, process_group(tsk));
+               __kill_pg_info(SIGCONT, SEND_SIG_PRIV, process_group(tsk));
        }
 
        /* Let father know we died 
@@ -766,10 +784,6 @@ static void exit_notify(struct task_struct *tsk)
        /* If the process is dead, release it - nobody will wait for it */
        if (state == EXIT_DEAD)
                release_task(tsk);
-
-       /* PF_DEAD causes final put_task_struct after we schedule. */
-       preempt_disable();
-       tsk->flags |= PF_DEAD;
 }
 
 fastcall NORET_TYPE void do_exit(long code)
@@ -779,6 +793,8 @@ fastcall NORET_TYPE void do_exit(long code)
 
        profile_task_exit(tsk);
 
+       WARN_ON(atomic_read(&tsk->fs_excl));
+
        if (unlikely(in_interrupt()))
                panic("Aiee, killing interrupt handler!");
        if (unlikely(!tsk->pid))
@@ -793,6 +809,17 @@ fastcall NORET_TYPE void do_exit(long code)
                ptrace_notify((PTRACE_EVENT_EXIT << 8) | SIGTRAP);
        }
 
+       /*
+        * We're taking recursive faults here in do_exit. Safest is to just
+        * leave this task alone and wait for reboot.
+        */
+       if (unlikely(tsk->flags & PF_EXITING)) {
+               printk(KERN_ALERT
+                       "Fixing recursive fault but reboot is needed!\n");
+               set_current_state(TASK_UNINTERRUPTIBLE);
+               schedule();
+       }
+
        tsk->flags |= PF_EXITING;
 
        /*
@@ -809,10 +836,16 @@ fastcall NORET_TYPE void do_exit(long code)
                                preempt_count());
 
        acct_update_integrals(tsk);
-       update_mem_hiwater(tsk);
+       if (tsk->mm) {
+               update_hiwater_rss(tsk->mm);
+               update_hiwater_vm(tsk->mm);
+       }
        group_dead = atomic_dec_and_test(&tsk->signal->live);
-       if (group_dead)
+       if (group_dead) {
+               del_timer_sync(&tsk->signal->real_timer);
+               exit_itimers(tsk->signal);
                acct_process(code);
+       }
        exit_mm(tsk);
 
        exit_sem(tsk);
@@ -831,13 +864,18 @@ fastcall NORET_TYPE void do_exit(long code)
                module_put(tsk->binfmt->module);
 
        tsk->exit_code = code;
+       proc_exit_connector(tsk);
        exit_notify(tsk);
 #ifdef CONFIG_NUMA
        mpol_free(tsk->mempolicy);
        tsk->mempolicy = NULL;
 #endif
 
-       BUG_ON(!(current->flags & PF_DEAD));
+       /* PF_DEAD causes final put_task_struct after we schedule. */
+       preempt_disable();
+       BUG_ON(tsk->flags & PF_DEAD);
+       tsk->flags |= PF_DEAD;
+
        schedule();
        BUG();
        /* Avoid "noreturn function does return".  */
@@ -1171,7 +1209,7 @@ static int wait_task_stopped(task_t *p, int delayed_group_leader, int noreap,
 
                exit_code = p->exit_code;
                if (unlikely(!exit_code) ||
-                   unlikely(p->state > TASK_STOPPED))
+                   unlikely(p->state & TASK_TRACED))
                        goto bail_ref;
                return wait_noreap_copyout(p, pid, uid,
                                           why, (exit_code << 8) | 0x7f,
@@ -1347,6 +1385,15 @@ repeat:
 
                        switch (p->state) {
                        case TASK_TRACED:
+                               /*
+                                * When we hit the race with PTRACE_ATTACH,
+                                * we will not report this child.  But the
+                                * race means it has not yet been moved to
+                                * our ptrace_children list, so we need to
+                                * set the flag here to avoid a spurious ECHILD
+                                * when the race happens with the only child.
+                                */
+                               flag = 1;
                                if (!my_ptrace_child(p))
                                        continue;
                                /*FALLTHROUGH*/