From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1762356AbYEFFpq (ORCPT ); Tue, 6 May 2008 01:45:46 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754146AbYEFFpR (ORCPT ); Tue, 6 May 2008 01:45:17 -0400 Received: from fgwmail5.fujitsu.co.jp ([192.51.44.35]:50567 "EHLO fgwmail5.fujitsu.co.jp" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751521AbYEFFpM (ORCPT ); Tue, 6 May 2008 01:45:12 -0400 Date: Tue, 06 May 2008 14:40:39 +0900 From: KOSAKI Motohiro To: Lee Schermerhorn , KAMEZAWA Hiroyuki , Balbir Singh , LKML , linux-mm , Andrew Morton Subject: on CONFIG_MM_OWNER=y, kernel panic is possible. Cc: kosaki.motohiro@jp.fujitsu.com Message-Id: <20080506142255.AC5D.KOSAKI.MOTOHIRO@jp.fujitsu.com> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Mailer: Becky! ver. 2.42 [ja] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org on CONFIG_MM_OWNER=y (that is automatically turned on by mem-cgroup), kernel panic is possible by following scenario in mm_update_next_owner(). 1. mm_update_next_owner() is called. 2. found caller task in do_each_thread() loop. 3. thus, BUG_ON(c == p) is true, it become kernel panic. end up, We should left out current task. Signed-off-by: KOSAKI Motohiro CC: Lee Schermerhorn CC: KAMEZAWA Hiroyuki CC: Balbir Singh --- kernel/exit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: b/kernel/exit.c =================================================================== --- a/kernel/exit.c 2008-05-04 22:57:23.000000000 +0900 +++ b/kernel/exit.c 2008-05-06 15:01:26.000000000 +0900 @@ -627,7 +627,7 @@ retry: * here often */ do_each_thread(g, c) { - if (c->mm == mm) + if ((c != p) && (c->mm == mm)) goto assign_new_owner; } while_each_thread(g, c);