From: Gao Yahu <yahu.gao@windriver.com>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: Yahu Gao <yahu.gao@windriver.com>,
Alexey Dobriyan <adobriyan@gmail.com>,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org
Subject: [PATCH v2] fs/proc: Fix NULL pointer dereference in pid_delete_dentry
Date: Thu, 07 Jan 2021 17:41:00 +0800 [thread overview]
Message-ID: <87lfd59j9v.fsf@pek-ygao-d1> (raw)
In-Reply-To: <20201209131652.GM3579531@ZenIV.linux.org.uk>
Get the staus of task from the pointer of proc inode directly is not
safe. Make it happen in RCU protection.
Signed-off-by: Yahu Gao <yahu.gao@windriver.com>
---
v2 changes:
- Use RCU lock to avoid NULL dereference of pid.
---
fs/proc/base.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index b3422cda2a91..d44b5f2414a6 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1,3 +1,4 @@
+
// SPDX-License-Identifier: GPL-2.0
/*
* linux/fs/proc/base.c
@@ -1994,7 +1995,16 @@ static int pid_revalidate(struct dentry *dentry, unsigned int flags)
static inline bool proc_inode_is_dead(struct inode *inode)
{
- return !proc_pid(inode)->tasks[PIDTYPE_PID].first;
+ struct pid *pid = NULL;
+ struct hlist_node *first = NULL;
+
+ rcu_read_lock();
+ pid = proc_pid(inode);
+ if (likely(pid))
+ first = rcu_dereference_check(hlist_first_rcu(&pid->tasks[PIDTYPE_PID]),
+ lockdep_tasklist_lock_is_held());
+ rcu_read_unlock();
+ return !first;
}
int pid_delete_dentry(const struct dentry *dentry)
--
2.25.1
next prev parent reply other threads:[~2021-01-07 9:42 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-09 11:20 Review request 0/1: fs/proc: Fix NULL pointer dereference in Yahu Gao
2020-12-09 11:21 ` [PATCH] fs/proc: Fix NULL pointer dereference in pid_delete_dentry Yahu Gao
2020-12-09 13:16 ` Al Viro
2021-01-07 9:41 ` Gao Yahu [this message]
2020-12-09 21:54 ` Review request 0/1: fs/proc: Fix NULL pointer dereference in Eric W. Biederman
2021-01-07 9:02 ` Gao Yahu
2021-01-07 9:03 ` Gao, Yahu
2021-01-07 9:07 ` Gao Yahu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87lfd59j9v.fsf@pek-ygao-d1 \
--to=yahu.gao@windriver.com \
--cc=adobriyan@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).