lkml.org 
[lkml]   [2021]   [Jan]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH v2] fs/proc: Fix NULL pointer dereference in pid_delete_dentry
Date

Get the staus of task from the pointer of proc inode directly is not
safe. Make it happen in RCU protection.

Signed-off-by: Yahu Gao <yahu.gao@windriver.com>
---
v2 changes:
- Use RCU lock to avoid NULL dereference of pid.
---
fs/proc/base.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index b3422cda2a91..d44b5f2414a6 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1,3 +1,4 @@
+
// SPDX-License-Identifier: GPL-2.0
/*
* linux/fs/proc/base.c
@@ -1994,7 +1995,16 @@ static int pid_revalidate(struct dentry *dentry, unsigned int flags)

static inline bool proc_inode_is_dead(struct inode *inode)
{
- return !proc_pid(inode)->tasks[PIDTYPE_PID].first;
+ struct pid *pid = NULL;
+ struct hlist_node *first = NULL;
+
+ rcu_read_lock();
+ pid = proc_pid(inode);
+ if (likely(pid))
+ first = rcu_dereference_check(hlist_first_rcu(&pid->tasks[PIDTYPE_PID]),
+ lockdep_tasklist_lock_is_held());
+ rcu_read_unlock();
+ return !first;
}

int pid_delete_dentry(const struct dentry *dentry)
--
2.25.1
\
 
 \ /
  Last update: 2021-01-07 10:44    [W:0.033 / U:0.224 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site