[PATCH] NUMA API: fix use-after-free bug

Move the memory policy freeing to later in exit to make sure the last
memory allocations don't use an uninitialized policy.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/kernel/exit.c b/kernel/exit.c
index cf71b30d8bd5992cec0fe411126969cea9471c29..2bab0bf9fe9704da3b3a8f99b76e487dcbb87651 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -828,9 +828,6 @@ asmlinkage NORET_TYPE void do_exit(long code)
        __exit_fs(tsk);
        exit_namespace(tsk);
        exit_thread();
-#ifdef CONFIG_NUMA
-       mpol_free(tsk->mempolicy);
-#endif
 
        if (tsk->signal->leader)
                disassociate_ctty(1);
@@ -841,6 +838,10 @@ asmlinkage NORET_TYPE void do_exit(long code)
 
        tsk->exit_code = code;
        exit_notify(tsk);
+#ifdef CONFIG_NUMA
+       mpol_free(tsk->mempolicy);
+       tsk->mempolicy = NULL;
+#endif
        schedule();
        BUG();
        /* Avoid "noreturn function does return".  */