From: Prasanna Meda Looking at get_task_comm patch: http://linus.bkbits.net:8080/linux-2.5/patch@1.1803.144.3 There is one other place where task->comm is accessed outside current. There are two issues. The code is trying to copy to temp space without task_lock. It is not using temp space for actual user copy. Signed-off-by: Andrew Morton --- 25-akpm/arch/mips/kernel/sysirix.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff -puN arch/mips/kernel/sysirix.c~unlocked-access-to-task-comm arch/mips/kernel/sysirix.c --- 25/arch/mips/kernel/sysirix.c~unlocked-access-to-task-comm Wed Nov 17 14:23:21 2004 +++ 25-akpm/arch/mips/kernel/sysirix.c Wed Nov 17 14:23:21 2004 @@ -287,9 +287,9 @@ asmlinkage int irix_syssgi(struct pt_reg int pid = (int) regs->regs[base + 5]; char *buf = (char *) regs->regs[base + 6]; struct task_struct *p; - char comm[16]; + char tcomm[sizeof(current->comm)]; - retval = verify_area(VERIFY_WRITE, buf, 16); + retval = verify_area(VERIFY_WRITE, buf, sizeof(tcomm)); if (retval) break; read_lock(&tasklist_lock); @@ -299,11 +299,11 @@ asmlinkage int irix_syssgi(struct pt_reg retval = -ESRCH; break; } - memcpy(comm, p->comm, 16); + get_task_comm(tcomm, p); read_unlock(&tasklist_lock); /* XXX Need to check sizes. */ - copy_to_user(buf, p->comm, 16); + copy_to_user(buf, tcomm, sizeof(tcomm)); retval = 0; break; } _