Messages in this thread | | | Date | Thu, 23 Nov 2006 09:28:05 +0100 | From | Sébastien Dugué <> | Subject | Re: [PATCH -mm 3/4][AIO] - AIO completion signal notification |
| |
On Tue, 21 Nov 2006 17:02:28 -0800 Andrew Morton <akpm@osdl.org> wrote:
> On Mon, 20 Nov 2006 15:22:52 +0100 > S__bastien Dugu__ <sebastien.dugue@bull.net> wrote: > > > +static long aio_setup_sigevent(struct aio_notify *notify, > > + struct sigevent __user *user_event) > > +{ > > + sigevent_t event; > > + struct task_struct *target; > > + > > + if (copy_from_user(&event, user_event, sizeof (event))) > > + return -EFAULT; > > + > > + if (event.sigev_notify == SIGEV_NONE) > > + return 0; > > + > > + notify->notify = event.sigev_notify; > > + notify->signo = event.sigev_signo; > > + notify->value = event.sigev_value; > > + > > + read_lock(&tasklist_lock); > > + target = good_sigevent(&event); > > + > > + if (unlikely(!target || (target->flags & PF_EXITING))) > > + goto out_unlock; > > + > > + > > + > > + if (notify->notify == (SIGEV_SIGNAL|SIGEV_THREAD_ID)) { > > + /* > > + * This reference will be dropped in really_put_req() when > > + * we're done with the request. > > + */ > > + get_task_struct(target); > > + } > > It worries me that this function can save away a task_struct* without > having taken a reference against it. >
OK. Does moving 'notify->target = target;' after the get_task_struct() will do, or am I missing something more subtle?
Thanks,
Sébastien. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |