rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONE_NEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon that uses PID namespaces to isolate clients, as demonstrated by vsftpd.
Vulnerability ID: CVE-2012-2127
CWE: CWE-119
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-06-21
File: fs/proc/root.c
Commit message: procfs: fix a vfsmount longterm reference leak

kern_mount() doesn't pair with plain mntput()...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Commit author: Al Viro

Vulnerable version (before fix):
 static struct file_system_type proc_fs_type = {  void __init proc_root_init(void) { 	struct vfsmount *mnt; 	int err;  	proc_init_inodecache(); 	err = register_filesystem(&proc_fs_type); 	if (err) 		return; 	mnt = kern_mount_data(&proc_fs_type, &init_pid_ns); 	if (IS_ERR(mnt)) { 		unregister_filesystem(&proc_fs_type); 		return; 	}  	init_pid_ns.proc_mnt = mnt; 	proc_symlink("mounts", NULL, "self/mounts");  	proc_net_init(); int pid_ns_prepare_proc(struct pid_namespace *ns)  void pid_ns_release_proc(struct pid_namespace *ns) { 	mntput(ns->proc_mnt); }

Fixed version (after fix):
 static struct file_system_type proc_fs_type = {  void __init proc_root_init(void) { 	int err;  	proc_init_inodecache(); 	err = register_filesystem(&proc_fs_type); 	if (err) 		return; 	err = pid_ns_prepare_proc(&init_pid_ns); 	if (err) { 		unregister_filesystem(&proc_fs_type); 		return; 	}  	proc_symlink("mounts", NULL, "self/mounts");  	proc_net_init(); int pid_ns_prepare_proc(struct pid_namespace *ns)  void pid_ns_release_proc(struct pid_namespace *ns) { 	kern_unmount(ns->proc_mnt); }

Patch:
patch: @@ -91,20 +91,18 @@ static struct file_system_type proc_fs_type = {
 
 void __init proc_root_init(void)
 {
-	struct vfsmount *mnt;
 	int err;
 
 	proc_init_inodecache();
 	err = register_filesystem(&proc_fs_type);
 	if (err)
 		return;
-	mnt = kern_mount_data(&proc_fs_type, &init_pid_ns);
-	if (IS_ERR(mnt)) {
+	err = pid_ns_prepare_proc(&init_pid_ns);
+	if (err) {
 		unregister_filesystem(&proc_fs_type);
 		return;
 	}
 
-	init_pid_ns.proc_mnt = mnt;
 	proc_symlink("mounts", NULL, "self/mounts");
 
 	proc_net_init();
@@ -209,5 +207,5 @@ int pid_ns_prepare_proc(struct pid_namespace *ns)
 
 void pid_ns_release_proc(struct pid_namespace *ns)
 {
-	mntput(ns->proc_mnt);
+	kern_unmount(ns->proc_mnt);
 }
path: fs/proc/root.c
Vulnerability: Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.
Vulnerability ID: CVE-2012-2129
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/splitbrain/dokuwiki
Published: 2012-08-27
File: inc/html.php
Commit message: escape target error message (SECURITY) FS#2487 FS#2488

The error message when a non-existant editor was tried to load wasn't
escaped correctly, allowing to introduce arbitrary JavaScript to the
output, leading to a XSS vulnerability.

Note: the reported second XCRF vulnerability is the same bug, the xploit
code simply uses JavaScript to extract a valid CSRF token from the site
Commit author: Andreas Gohr

Vulnerable version (before fix):
 function html_edit_form($param) {     global $TEXT;      if ($param['target'] !== 'section') {         msg('No editor for edit target ' . $param['target'] . ' found.', -1);     }      $attr = array('tabindex'=>'1');

Fixed version (after fix):
 function html_edit_form($param) {     global $TEXT;      if ($param['target'] !== 'section') {         msg('No editor for edit target ' . hsc($param['target']) . ' found.', -1);     }      $attr = array('tabindex'=>'1');

Patch:
patch: @@ -1436,7 +1436,7 @@ function html_edit_form($param) {
     global $TEXT;
 
     if ($param['target'] !== 'section') {
-        msg('No editor for edit target ' . $param['target'] . ' found.', -1);
+        msg('No editor for edit target ' . hsc($param['target']) . ' found.', -1);
     }
 
     $attr = array('tabindex'=>'1');
path: inc/html.php
Vulnerability: The sock_alloc_send_pskb function in net/core/sock.c in the Linux kernel before 3.4.5 does not properly validate a certain length value, which allows local users to cause a denial of service (heap-based buffer overflow and system crash) or possibly gain privileges by leveraging access to a TUN/TAP device.
Vulnerability ID: CVE-2012-2136
CWE: CWE-20
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2012-08-09
File: net/core/sock.c
Commit message: net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()

We need to validate the number of pages consumed by data_len, otherwise frags
array could be overflowed by userspace. So this patch validate data_len and
return -EMSGSIZE when data_len may occupies more frags than MAX_SKB_FRAGS.

Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Jason Wang

Vulnerable version (before fix):
 struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len, 	gfp_t gfp_mask; 	long timeo; 	int err;  	gfp_mask = sk->sk_allocation; 	if (gfp_mask & __GFP_WAIT) struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len, 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) { 			skb = alloc_skb(header_len, gfp_mask); 			if (skb) { 				int npages; 				int i;  				/* No pages, we're done... */ 				if (!data_len) 					break;  				npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT; 				skb->truesize += data_len; 				skb_shinfo(skb)->nr_frags = npages; 				for (i = 0; i < npages; i++) {

Fixed version (after fix):
 struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len, 	gfp_t gfp_mask; 	long timeo; 	int err; 	int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;  	err = -EMSGSIZE; 	if (npages > MAX_SKB_FRAGS) 		goto failure;  	gfp_mask = sk->sk_allocation; 	if (gfp_mask & __GFP_WAIT) struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len, 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) { 			skb = alloc_skb(header_len, gfp_mask); 			if (skb) { 				int i;  				/* No pages, we're done... */ 				if (!data_len) 					break;  				skb->truesize += data_len; 				skb_shinfo(skb)->nr_frags = npages; 				for (i = 0; i < npages; i++) {

Patch:
patch: @@ -1592,6 +1592,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
 	gfp_t gfp_mask;
 	long timeo;
 	int err;
+	int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+
+	err = -EMSGSIZE;
+	if (npages > MAX_SKB_FRAGS)
+		goto failure;
 
 	gfp_mask = sk->sk_allocation;
 	if (gfp_mask & __GFP_WAIT)
@@ -1610,14 +1615,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
 		if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
 			skb = alloc_skb(header_len, gfp_mask);
 			if (skb) {
-				int npages;
 				int i;
 
 				/* No pages, we're done... */
 				if (!data_len)
 					break;
 
-				npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
 				skb->truesize += data_len;
 				skb_shinfo(skb)->nr_frags = npages;
 				for (i = 0; i < npages; i++) {
path: net/core/sock.c
Vulnerability: The __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the NFSv4 implementation in the Linux kernel before 3.3.2 uses an incorrect length variable during a copy operation, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words in an FATTR4_ACL reply.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-4131.
Vulnerability ID: CVE-2012-2375
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-06-13
File: fs/nfs/nfs4proc.c
Commit message: Fix length of buffer copied in __nfs4_get_acl_uncached

_copy_from_pages() used to copy data from the temporary buffer to the
user passed buffer is passed the wrong size parameter when copying
data. res.acl_len contains both the bitmap and acl lenghts while
acl_len contains the acl length after adjusting for the bitmap size.

Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Commit author: Sachin Prabhu

Vulnerable version (before fix):
 static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu 		if (acl_len > buflen) 			goto out_free; 		_copy_from_pages(buf, pages, res.acl_data_offset, 				res.acl_len); 	} 	ret = acl_len; out_free:

Fixed version (after fix):
 static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu 		if (acl_len > buflen) 			goto out_free; 		_copy_from_pages(buf, pages, res.acl_data_offset, 				acl_len); 	} 	ret = acl_len; out_free:

Patch:
patch: @@ -3712,7 +3712,7 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
 		if (acl_len > buflen)
 			goto out_free;
 		_copy_from_pages(buf, pages, res.acl_data_offset,
-				res.acl_len);
+				acl_len);
 	}
 	ret = acl_len;
 out_free:
path: fs/nfs/nfs4proc.c
Vulnerability: Integer overflow in the i915_gem_execbuffer2 function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
Vulnerability ID: CVE-2012-2383
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-06-13
File: drivers/gpu/drm/i915/i915_gem_execbuffer.c
Commit message: drm/i915: fix integer overflow in i915_gem_execbuffer2()

On 32-bit systems, a large args->buffer_count from userspace via ioctl
may overflow the allocation size, leading to out-of-bounds access.

This vulnerability was introduced in commit 8408c282 ("drm/i915:
First try a normal large kmalloc for the temporary exec buffers").

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Commit author: Xi Wang

Vulnerable version (before fix):
 i915_gem_execbuffer2(struct drm_device *dev, void *data, 	struct drm_i915_gem_exec_object2 *exec2_list = NULL; 	int ret;  	if (args->buffer_count < 1) { 		DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count); 		return -EINVAL; 	}

Fixed version (after fix):
 i915_gem_execbuffer2(struct drm_device *dev, void *data, 	struct drm_i915_gem_exec_object2 *exec2_list = NULL; 	int ret;  	if (args->buffer_count < 1 || 	    args->buffer_count > UINT_MAX / sizeof(*exec2_list)) { 		DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count); 		return -EINVAL; 	}

Patch:
patch: @@ -1404,7 +1404,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
 	struct drm_i915_gem_exec_object2 *exec2_list = NULL;
 	int ret;
 
-	if (args->buffer_count < 1) {
+	if (args->buffer_count < 1 ||
+	    args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
 		DRM_DEBUG("execbuf2 with %d buffers\n", args->buffer_count);
 		return -EINVAL;
 	}
path: drivers/gpu/drm/i915/i915_gem_execbuffer.c
Vulnerability: Integer overflow in the i915_gem_do_execbuffer function in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.3.5 on 32-bit platforms allows local users to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted ioctl call.
Vulnerability ID: CVE-2012-2384
CWE: CWE-189
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-06-13
File: drivers/gpu/drm/i915/i915_gem_execbuffer.c
Commit message: drm/i915: fix integer overflow in i915_gem_do_execbuffer()

On 32-bit systems, a large args->num_cliprects from userspace via ioctl
may overflow the allocation size, leading to out-of-bounds access.

This vulnerability was introduced in commit 432e58ed ("drm/i915: Avoid
allocation for execbuffer object list").

Signed-off-by: Xi Wang <xi.wang@gmail.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Commit author: Xi Wang

Vulnerable version (before fix):
 i915_gem_do_execbuffer(struct drm_device *dev, void *data, 			return -EINVAL; 		}  		cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects), 				    GFP_KERNEL); 		if (cliprects == NULL) {

Fixed version (after fix):
 i915_gem_do_execbuffer(struct drm_device *dev, void *data, 			return -EINVAL; 		}  		if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) { 			DRM_DEBUG("execbuf with %u cliprects\n", 				  args->num_cliprects); 			return -EINVAL; 		} 		cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects), 				    GFP_KERNEL); 		if (cliprects == NULL) {

Patch:
patch: @@ -1133,6 +1133,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
 			return -EINVAL;
 		}
 
+		if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
+			DRM_DEBUG("execbuf with %u cliprects\n",
+				  args->num_cliprects);
+			return -EINVAL;
+		}
 		cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
 				    GFP_KERNEL);
 		if (cliprects == NULL) {
path: drivers/gpu/drm/i915/i915_gem_execbuffer.c
Vulnerability: The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.
Vulnerability ID: CVE-2012-2669
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2012-12-27
File: tools/hv/hv_kvp_daemon.c
Commit message: Tools: hv: verify origin of netlink connector message

The SuSE security team suggested to use recvfrom instead of recv to be
certain that the connector message is originated from kernel.

CVE-2012-2669

Signed-off-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Marcus Meissner <meissner@suse.de>
Signed-off-by: Sebastian Krahmer <krahmer@suse.de>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Olaf Hering

Vulnerable version (before fix):
 int main(void) 	pfd.fd = fd;  	while (1) { 		pfd.events = POLLIN; 		pfd.revents = 0; 		poll(&pfd, 1, -1);  		len = recv(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0);  		if (len < 0) { 			syslog(LOG_ERR, "recv failed; error:%d", len); 			close(fd); 			return -1; 		}

Fixed version (after fix):
 int main(void) 	pfd.fd = fd;  	while (1) { 		struct sockaddr *addr_p = (struct sockaddr *) &addr; 		socklen_t addr_l = sizeof(addr); 		pfd.events = POLLIN; 		pfd.revents = 0; 		poll(&pfd, 1, -1);  		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0, 				addr_p, &addr_l);  		if (len < 0 || addr.nl_pid) { 			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s", 					addr.nl_pid, errno, strerror(errno)); 			close(fd); 			return -1; 		}

Patch:
patch: @@ -701,14 +701,18 @@ int main(void)
 	pfd.fd = fd;
 
 	while (1) {
+		struct sockaddr *addr_p = (struct sockaddr *) &addr;
+		socklen_t addr_l = sizeof(addr);
 		pfd.events = POLLIN;
 		pfd.revents = 0;
 		poll(&pfd, 1, -1);
 
-		len = recv(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0);
+		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,
+				addr_p, &addr_l);
 
-		if (len < 0) {
-			syslog(LOG_ERR, "recv failed; error:%d", len);
+		if (len < 0 || addr.nl_pid) {
+			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s",
+					addr.nl_pid, errno, strerror(errno));
 			close(fd);
 			return -1;
 		}
path: tools/hv/hv_kvp_daemon.c
Vulnerability: The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
Vulnerability ID: CVE-2012-2745
CWE: CWE-119
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2012-08-09
File: kernel/cred.c
Commit message: cred: copy_process() should clear child->replacement_session_keyring

keyctl_session_to_parent(task) sets ->replacement_session_keyring,
it should be processed and cleared by key_replace_session_keyring().

However, this task can fork before it notices TIF_NOTIFY_RESUME and
the new child gets the bogus ->replacement_session_keyring copied by
dup_task_struct(). This is obviously wrong and, if nothing else, this
leads to put_cred(already_freed_cred).

change copy_creds() to clear this member. If copy_process() fails
before this point the wrong ->replacement_session_keyring doesn't
matter, exit_creds() won't be called.

Cc: <stable@vger.kernel.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Oleg Nesterov

Vulnerable version (before fix):
 int copy_creds(struct task_struct *p, unsigned long clone_flags) 	struct cred *new; 	int ret;  	if ( #ifdef CONFIG_KEYS 		!p->cred->thread_keyring &&

Fixed version (after fix):
 int copy_creds(struct task_struct *p, unsigned long clone_flags) 	struct cred *new; 	int ret;  	p->replacement_session_keyring = NULL;  	if ( #ifdef CONFIG_KEYS 		!p->cred->thread_keyring &&

Patch:
patch: @@ -386,6 +386,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags)
 	struct cred *new;
 	int ret;
 
+	p->replacement_session_keyring = NULL;
+
 	if (
 #ifdef CONFIG_KEYS
 		!p->cred->thread_keyring &&
path: kernel/cred.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.
Vulnerability ID: CVE-2012-3382
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/mono/mono
Published: 2012-07-12
File: mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs
Commit message: HtmlEncode the path

	Fixes Novell bug #769799.
Commit author: Gonzalo Paniagua Javier

Vulnerable version (before fix):
 public void ProcessRequest (HttpContext context) 				 			throw new HttpException (403, 						 "This type of page is not served.", 						 req != null ? req.Path : null, 						 description); 		} 

Fixed version (after fix):
 public void ProcessRequest (HttpContext context) 				 			throw new HttpException (403, 						 "This type of page is not served.", 						 req != null ? HttpUtility.HtmlEncode (req.Path) : null, 						 description); 		} 

Patch:
patch: @@ -42,7 +42,7 @@ public void ProcessRequest (HttpContext context)
 				
 			throw new HttpException (403,
 						 "This type of page is not served.",
-						 req != null ? req.Path : null,
+						 req != null ? HttpUtility.HtmlEncode (req.Path) : null,
 						 description);
 		}
path: mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs
Vulnerability: Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.
Vulnerability ID: CVE-2012-3510
CWE: CWE-399
Severity score: 7.8
Project: https://github.com/torvalds/linux
Published: 2012-10-03
File: kernel/tsacct.c
Commit message: [PATCH] xacct_add_tsk: fix pure theoretical ->mm use-after-free

Paranoid fix. The task can free its ->mm after the 'if (p->mm)' check.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Cc: Shailabh Nagar <nagar@watson.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Jay Lan <jlan@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Commit author: Oleg Nesterov

Vulnerable version (before fix):
 void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)  */ void xacct_add_tsk(struct taskstats *stats, struct task_struct *p) { 	/* convert pages-jiffies to Mbyte-usec */ 	stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB; 	stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB; 	if (p->mm) { 		/* adjust to KB unit */ 		stats->hiwater_rss   = p->mm->hiwater_rss * PAGE_SIZE / KB; 		stats->hiwater_vm    = p->mm->hiwater_vm * PAGE_SIZE / KB; 	} 	stats->read_char	= p->rchar; 	stats->write_char	= p->wchar;

Fixed version (after fix):
 void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)  */ void xacct_add_tsk(struct taskstats *stats, struct task_struct *p) { 	struct mm_struct *mm;  	/* convert pages-jiffies to Mbyte-usec */ 	stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB; 	stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB; 	mm = get_task_mm(p); 	if (mm) { 		/* adjust to KB unit */ 		stats->hiwater_rss   = mm->hiwater_rss * PAGE_SIZE / KB; 		stats->hiwater_vm    = mm->hiwater_vm * PAGE_SIZE / KB; 		mmput(mm); 	} 	stats->read_char	= p->rchar; 	stats->write_char	= p->wchar;

Patch:
patch: @@ -80,13 +80,17 @@ void bacct_add_tsk(struct taskstats *stats, struct task_struct *tsk)
  */
 void xacct_add_tsk(struct taskstats *stats, struct task_struct *p)
 {
+	struct mm_struct *mm;
+
 	/* convert pages-jiffies to Mbyte-usec */
 	stats->coremem = jiffies_to_usecs(p->acct_rss_mem1) * PAGE_SIZE / MB;
 	stats->virtmem = jiffies_to_usecs(p->acct_vm_mem1) * PAGE_SIZE / MB;
-	if (p->mm) {
+	mm = get_task_mm(p);
+	if (mm) {
 		/* adjust to KB unit */
-		stats->hiwater_rss   = p->mm->hiwater_rss * PAGE_SIZE / KB;
-		stats->hiwater_vm    = p->mm->hiwater_vm * PAGE_SIZE / KB;
+		stats->hiwater_rss   = mm->hiwater_rss * PAGE_SIZE / KB;
+		stats->hiwater_vm    = mm->hiwater_vm * PAGE_SIZE / KB;
+		mmput(mm);
 	}
 	stats->read_char	= p->rchar;
 	stats->write_char	= p->wchar;
path: kernel/tsacct.c