diff options
author | Steve French <sfrench@us.ibm.com> | 2010-12-03 03:52:43 +0000 |
---|---|---|
committer | Steve French <sfrench@us.ibm.com> | 2010-12-03 03:52:43 +0000 |
commit | ebb27386ffd2fcd0fad141e0eee97b8070f94ee2 (patch) | |
tree | 3c71ee87e8771ac0eed912729605dbaf3f39348c /kernel | |
parent | 6d20e8406f0942228a73000663c2b33f488103ea (diff) | |
parent | 59e57c622c3502346e8f930421ebc482d639520c (diff) | |
download | linux-ebb27386ffd2fcd0fad141e0eee97b8070f94ee2.tar.bz2 |
Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/exit.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/kernel/exit.c b/kernel/exit.c index 21aa7b3001fb..676149a4ac5f 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -914,6 +914,15 @@ NORET_TYPE void do_exit(long code) if (unlikely(!tsk->pid)) panic("Attempted to kill the idle task!"); + /* + * If do_exit is called because this processes oopsed, it's possible + * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before + * continuing. Amongst other possible reasons, this is to prevent + * mm_release()->clear_child_tid() from writing to a user-controlled + * kernel address. + */ + set_fs(USER_DS); + tracehook_report_exit(&code); validate_creds_for_do_exit(tsk); |