Commit fed57011 authored by Hailong.Liu's avatar Hailong.Liu Committed by Will Deacon
Browse files

ANDROID: mm/oom_kill: fix task_struct refcount_t: underflow;


use-after-free.

__wake_oom_reaper() is supposed to be called after get_task_struct()
and oom_reap_task() will later drop that reference. Therefore
add_to_oom_reaper() should not drop the reference count itself,
unless someone else already queued the same task for reaping.

Bug: 265591293
Bug: 269700060
Fixes: 561fe20b ("ANDROID: signal: Add vendor hook for memory reaping")
Change-Id: I4ed7f4bbac46552671de76aa1a212bec8b35144c
Signed-off-by: default avatarHailong.Liu <liuhailong@oppo.com>
(cherry picked from commit 016d6109)
parent 8fda4037
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment