diff options
| author | Oleg Nesterov <[email protected]> | 2014-04-07 15:38:29 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2014-04-07 16:36:03 -0700 |
| commit | c39df5fa37b0623589508c95515b4aa1531c524e (patch) | |
| tree | a6556cb0f29bed429e17c8f6c6c41f95b4f96d72 | |
| parent | 5d2d42de185b77b4bc60b5ac77386c4099d71bf3 (diff) | |
exit: call disassociate_ctty() before exit_task_namespaces()
Commit 8aac62706ada ("move exit_task_namespaces() outside of
exit_notify()") breaks pppd and the exiting service crashes the kernel:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
IP: ppp_register_channel+0x13/0x20 [ppp_generic]
Call Trace:
ppp_asynctty_open+0x12b/0x170 [ppp_async]
tty_ldisc_open.isra.2+0x27/0x60
tty_ldisc_hangup+0x1e3/0x220
__tty_hangup+0x2c4/0x440
disassociate_ctty+0x61/0x270
do_exit+0x7f2/0xa50
ppp_register_channel() needs ->net_ns and current->nsproxy == NULL.
Move disassociate_ctty() before exit_task_namespaces(), it doesn't make
sense to delay it after perf_event_exit_task() or cgroup_exit().
This also allows to use task_work_add() inside the (nontrivial) code
paths in disassociate_ctty().
Investigated by Peter Hurley.
Signed-off-by: Oleg Nesterov <[email protected]>
Reported-by: Sree Harsha Totakura <[email protected]>
Cc: Peter Hurley <[email protected]>
Cc: Sree Harsha Totakura <[email protected]>
Cc: "Eric W. Biederman" <[email protected]>
Cc: Jeff Dike <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Andrey Vagin <[email protected]>
Cc: Al Viro <[email protected]>
Cc: <[email protected]> [v3.10+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
| -rw-r--r-- | kernel/exit.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/kernel/exit.c b/kernel/exit.c index 6480d1c85d7a..11f9e39a7368 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -784,6 +784,8 @@ void do_exit(long code) exit_shm(tsk); exit_files(tsk); exit_fs(tsk); + if (group_dead) + disassociate_ctty(1); exit_task_namespaces(tsk); exit_task_work(tsk); check_stack_usage(); @@ -799,13 +801,9 @@ void do_exit(long code) cgroup_exit(tsk); - if (group_dead) - disassociate_ctty(1); - module_put(task_thread_info(tsk)->exec_domain->module); proc_exit_connector(tsk); - /* * FIXME: do that only when needed, using sched_exit tracepoint */ |