From: Oleg Nesterov task_state() needs tasklist_lock to protect ->parent/->real_parent. However task->parent points to nowhere only when the actions below happen in order 1) release_task(task) 2) release_task(task->parent) 3) a grace period passed But 3) implies that the memory ops from 1) should be finished, so pid_alive() can't be true in such a case. Otherwise, we don't care if ->parent/->real_parent changes under us. Signed-off-by: Oleg Nesterov Cc: "Eric W. Biederman" Signed-off-by: Andrew Morton --- fs/proc/array.c | 11 +++++------ 1 files changed, 5 insertions(+), 6 deletions(-) diff -puN fs/proc/array.c~proc-drop-tasklist-lock-in-task_state fs/proc/array.c --- a/fs/proc/array.c~proc-drop-tasklist-lock-in-task_state +++ a/fs/proc/array.c @@ -162,7 +162,7 @@ static inline char * task_state(struct t int g; struct fdtable *fdt = NULL; - read_lock(&tasklist_lock); + rcu_read_lock(); buffer += sprintf(buffer, "State:\t%s\n" "SleepAVG:\t%lu%%\n" @@ -174,14 +174,13 @@ static inline char * task_state(struct t "Gid:\t%d\t%d\t%d\t%d\n", get_task_state(p), (p->sleep_avg/1024)*100/(1020000000/1024), - p->tgid, - p->pid, pid_alive(p) ? p->group_leader->real_parent->tgid : 0, - pid_alive(p) && p->ptrace ? p->parent->pid : 0, + p->tgid, p->pid, + pid_alive(p) ? rcu_dereference(p->real_parent)->tgid : 0, + pid_alive(p) && p->ptrace ? rcu_dereference(p->parent)->pid : 0, p->uid, p->euid, p->suid, p->fsuid, p->gid, p->egid, p->sgid, p->fsgid); - read_unlock(&tasklist_lock); + task_lock(p); - rcu_read_lock(); if (p->files) fdt = files_fdtable(p->files); buffer += sprintf(buffer, _