linux-kernel - Re: [syzbot] [mptcp?] general protection fault in proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250103103255.1309-1-hdanton@sina.com>
Date: Fri,  3 Jan 2025 18:32:52 +0800
From: Hillf Danton <hdanton@...a.com>
To: syzbot <syzbot+e364f774c6f57f2c86d1@...kaller.appspotmail.com>
Cc: linux-kernel@...r.kernel.org,
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [mptcp?] general protection fault in proc_scheduler

On Thu, Jan 2, 2025 at 3:12 PM syzbot
> syzbot found the following issue on:
>
> HEAD commit:    ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
> git tree:       upstream
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1245eaf8580000

#syz test

--- x/net/mptcp/ctrl.c
+++ y/net/mptcp/ctrl.c
@@ -122,7 +122,7 @@ static int mptcp_set_scheduler(const str
 static int proc_scheduler(const struct ctl_table *ctl, int write,
 			  void *buffer, size_t *lenp, loff_t *ppos)
 {
-	const struct net *net = current->nsproxy->net_ns;
+	const struct net *net;
 	char val[MPTCP_SCHED_NAME_MAX];
 	struct ctl_table tbl = {
 		.data = val,
@@ -130,6 +130,9 @@ static int proc_scheduler(const struct c
 	};
 	int ret;
 
+	if (current->flags & PF_EXITING)
+		return -ENXIO;
+	net = current->nsproxy->net_ns;
 	strscpy(val, mptcp_get_scheduler(net), MPTCP_SCHED_NAME_MAX);
 
 	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
@@ -161,9 +164,12 @@ static int proc_blackhole_detect_timeout
 					 int write, void *buffer, size_t *lenp,
 					 loff_t *ppos)
 {
-	struct mptcp_pernet *pernet = mptcp_get_pernet(current->nsproxy->net_ns);
+	struct mptcp_pernet *pernet;
 	int ret;
 
+	if (current->flags & PF_EXITING)
+		return -ENXIO;
+	pernet = mptcp_get_pernet(current->nsproxy->net_ns);
 	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 	if (write && ret == 0)
 		atomic_set(&pernet->active_disable_times, 0);
--