We don't need to wait for task in-activity in release_task() any more,

since we now properly reference-count the allocations and thus can't
be freeing the thread structures from underneath the task running on
another CPU.

Move "free_uid(p->user)" and "security_task_free()" to __put_task_struct(),
so that we're guaranteed to always have a user structure pointer.

kernel/exit.c

@@ -66,12 +66,7 @@ void release_task(struct task_struct * p)
  
 	BUG_ON(p->state < TASK_ZOMBIE);
  
-	if (p != current)
-		wait_task_inactive(p);
-
 	atomic_dec(&p->user->processes);
-	security_task_free(p);
-	free_uid(p->user);
 	write_lock_irq(&tasklist_lock);
 	if (unlikely(p->ptrace))
 		__ptrace_unlink(p);

kernel/fork.c

@@ -76,7 +76,17 @@ void __put_task_struct(struct task_struct *tsk)
 {
 	WARN_ON(!(tsk->state & (TASK_DEAD | TASK_ZOMBIE)));
 	WARN_ON(atomic_read(&tsk->usage));
+	WARN_ON(tsk == current);
 
+	security_task_free(tsk);
+	free_uid(tsk->user);
+
+	/*
+	 * The task cache is effectively disabled right now.
+	 * Do we want it? The slab cache already has per-cpu
+	 * stuff, but the thread info (usually a order-1 page
+	 * allocation) doesn't.
+	 */
 	if (tsk != current) {
 		free_thread_info(tsk->thread_info);
 		kmem_cache_free(task_struct_cachep,tsk);