linux-kernel - [PATCH] pid: handle a NULL dereference error case in find_task_by_pid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20230417113500.19610-1-sfoon.kim@samsung.com>
Date:   Mon, 17 Apr 2023 20:35:00 +0900
From:   Sung-hun Kim <sfoon.kim@...sung.com>
To:     brauner@...nel.org, linux-kernel@...r.kernel.org
Cc:     sungguk.na@...sung.com, sw0312.kim@...sung.com,
        Sung-hun Kim <sfoon.kim@...sung.com>
Subject: [PATCH] pid: handle a NULL dereference error case in
 find_task_by_pid_ns

A NULL dereference error is occurred when find_task_by_pid_ns is
called with a 'ns' argument which value is NULL. This situation
is incurred when the kernel tries to call find_task_by_pid_ns in
the process context which is in exiting. This is because, when
the process is exiting, it detaches its struct pid from the
task_struct. The function find_task_by_vpid, one of callers of
find_task_by_pid_ns, takes the result of task_active_pid_ns(current)
as an argument. But, task_active_pid_ns returns NULL if the
current process is in exiting. So, the kernel incurs a NULL
dereference error since find_task_by_pid_ns uses the argument
without NULL check.

This patch adds a NULL check routine in find_task_by_pid_ns. The
function returns NULL when NULL is given as an argument.

Signed-off-by: Sung-hun Kim <sfoon.kim@...sung.com>
---
 kernel/pid.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/pid.c b/kernel/pid.c
index 3fbc5e46b721..914aebe9fee8 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -412,9 +412,12 @@ EXPORT_SYMBOL(pid_task);
  */
 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
 {
+	struct task_struct *task = NULL;
 	RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
 			 "find_task_by_pid_ns() needs rcu_read_lock() protection");
-	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
+	if (likely(ns))
+		task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
+	return task;
 }

 struct task_struct *find_task_by_vpid(pid_t vnr)
-- 
2.17.1