task_sig() accesses __task_cred() without being in a RCU read side critical section. tasklist_lock is not protecting that when CONFIG_TREE_PREEMPT_RCU=y. Add a rcu_read_lock/unlock() section around the code which accesses __task_cred(). Signed-off-by: Thomas Gleixner Cc: David Howells Cc: James Morris Cc: linux-security-module@vger.kernel.org Cc: Al Viro --- fs/proc/array.c | 2 ++ 1 file changed, 2 insertions(+) Index: linux-2.6-tip/fs/proc/array.c =================================================================== --- linux-2.6-tip.orig/fs/proc/array.c +++ linux-2.6-tip/fs/proc/array.c @@ -265,7 +265,9 @@ static inline void task_sig(struct seq_f blocked = p->blocked; collect_sigign_sigcatch(p, &ignored, &caught); num_threads = atomic_read(&p->signal->count); + rcu_read_lock(); qsize = atomic_read(&__task_cred(p)->user->sigpending); + rcu_read_unlock(); qlim = p->signal->rlim[RLIMIT_SIGPENDING].rlim_cur; unlock_task_sighand(p, &flags); } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/