mm: fix NULL ptr dereference in move_pages
Sasha Levin [Wed, 25 Apr 2012 23:01:53 +0000 (16:01 -0700)]
Commit 3268c63 ("mm: fix move/migrate_pages() race on task struct") has
added an odd construct where 'mm' is checked for being NULL, and if it is,
it would get dereferenced anyways by mput()ing it.

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Hugh Dickins <hughd@google.com>
Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

mm/migrate.c

index 51c08a0..1107238 100644 (file)
@@ -1388,14 +1388,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
        mm = get_task_mm(task);
        put_task_struct(task);
 
-       if (mm) {
-               if (nodes)
-                       err = do_pages_move(mm, task_nodes, nr_pages, pages,
-                                           nodes, status, flags);
-               else
-                       err = do_pages_stat(mm, nr_pages, pages, status);
-       } else
-               err = -EINVAL;
+       if (!mm)
+               return -EINVAL;
+
+       if (nodes)
+               err = do_pages_move(mm, task_nodes, nr_pages, pages,
+                                   nodes, status, flags);
+       else
+               err = do_pages_stat(mm, nr_pages, pages, status);
 
        mmput(mm);
        return err;