From 8f464764a59d3b97077cbde0b73fb447ce1866c6 Mon Sep 17 00:00:00 2001
From: Nelson Elhage <nelhage@ksplice.com>
Date: Thu, 2 Dec 2010 14:31:21 -0800
Subject: [PATCH] --- yaml --- r: 222873 b: refs/heads/master c:
 33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177 h: refs/heads/master i:   222871:
 0672422ddea6cd4e50030e2db39ede3fc607fd0d v: v3

---
 [refs]              | 2 +-
 trunk/kernel/exit.c | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 7f5d8e219cb6..6c7bb7bb11ad 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: a0b0f58cdd32ab363a600a294ddaa90f0c32de8c
+refs/heads/master: 33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177
diff --git a/trunk/kernel/exit.c b/trunk/kernel/exit.c
index 21aa7b3001fb..676149a4ac5f 100644
--- a/trunk/kernel/exit.c
+++ b/trunk/kernel/exit.c
@@ -914,6 +914,15 @@ NORET_TYPE void do_exit(long code)
 	if (unlikely(!tsk->pid))
 		panic("Attempted to kill the idle task!");
 
+	/*
+	 * If do_exit is called because this processes oopsed, it's possible
+	 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
+	 * continuing. Amongst other possible reasons, this is to prevent
+	 * mm_release()->clear_child_tid() from writing to a user-controlled
+	 * kernel address.
+	 */
+	set_fs(USER_DS);
+
 	tracehook_report_exit(&code);
 
 	validate_creds_for_do_exit(tsk);