linux-kernel - [PATCH] pid: Add the judgment of whether ns is NULL in the find_pid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230713071713.5762-1-xuewen.yan@unisoc.com>
Date:   Thu, 13 Jul 2023 15:17:13 +0800
From:   Xuewen Yan <xuewen.yan@...soc.com>
To:     <brauner@...nel.org>, <jack@...e.cz>, <keescook@...omium.org>,
        <peterz@...radead.org>, <vincent.guittot@...aro.org>
CC:     <linux-kernel@...r.kernel.org>, <xuewen.yan@...soc.com>,
        <di.shen@...soc.com>
Subject: [PATCH] pid: Add the judgment of whether ns is NULL in the find_pid_ns

There is no the judgment of whether namspace is NULL in find_pid_ns.
But there is a corner case when ns is null, for example: if user
call find_get_pid when current is in exiting, the following stack would
set thread_id be null:
release_task
    __exit_signal(p);
        __unhash_process(tsk, group_dead);
              detach_pid(p, PIDTYPE_PID);
                  __change_pid(task, type, NULL);

If user call find_get_pid at now, in find_vpid function, the
task_active_pid_ns would return NULL. As a result, it would be
error when access the ns in find_pid_ns.

So add the judgment of whether ns is NULL in the find_pid_ns to
prevent this case happen.

Signed-off-by: Xuewen Yan <xuewen.yan@...soc.com>
---
 kernel/pid.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/pid.c b/kernel/pid.c
index 6a1d23a11026..d4a9cb6f3eb9 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -308,6 +308,9 @@ void disable_pid_allocation(struct pid_namespace *ns)
 
 struct pid *find_pid_ns(int nr, struct pid_namespace *ns)
 {
+	if (!ns)
+		return NULL;
+
 	return idr_find(&ns->idr, nr);
 }
 EXPORT_SYMBOL_GPL(find_pid_ns);
-- 
2.25.1