Messages in this thread Patch in this message | ![/](/images/icornerl.gif) | | From | Gao Yahu <> | Subject | [PATCH v2] fs/proc: Fix NULL pointer dereference in pid_delete_dentry | Date | Thu, 07 Jan 2021 17:41:00 +0800 |
| |
Get the staus of task from the pointer of proc inode directly is not safe. Make it happen in RCU protection.
Signed-off-by: Yahu Gao <yahu.gao@windriver.com> --- v2 changes: - Use RCU lock to avoid NULL dereference of pid. --- fs/proc/base.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c index b3422cda2a91..d44b5f2414a6 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1,3 +1,4 @@ + // SPDX-License-Identifier: GPL-2.0 /* * linux/fs/proc/base.c @@ -1994,7 +1995,16 @@ static int pid_revalidate(struct dentry *dentry, unsigned int flags) static inline bool proc_inode_is_dead(struct inode *inode) { - return !proc_pid(inode)->tasks[PIDTYPE_PID].first; + struct pid *pid = NULL; + struct hlist_node *first = NULL; + + rcu_read_lock(); + pid = proc_pid(inode); + if (likely(pid)) + first = rcu_dereference_check(hlist_first_rcu(&pid->tasks[PIDTYPE_PID]), + lockdep_tasklist_lock_is_held()); + rcu_read_unlock(); + return !first; } int pid_delete_dentry(const struct dentry *dentry) -- 2.25.1
| ![\](/images/icornerr.gif) |