linux-kernel - Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20260107024312.2868774-1-wangqing7171@gmail.com>
Date: Wed,  7 Jan 2026 10:43:12 +0800
From: Qing Wang <wangqing7171@...il.com>
To: oleg@...hat.com
Cc: Liam.Howlett@...cle.com,
	akpm@...ux-foundation.org,
	brauner@...nel.org,
	bsegall@...gle.com,
	david@...nel.org,
	dietmar.eggemann@....com,
	jack@...e.cz,
	joel.granados@...nel.org,
	juri.lelli@...hat.com,
	linux-kernel@...r.kernel.org,
	lorenzo.stoakes@...cle.com,
	mingo@...hat.com,
	mjguzik@...il.com,
	peterz@...radead.org,
	rostedt@...dmis.org,
	rppt@...nel.org,
	syzbot+e0378d4f4fe57aa2bdd0@...kaller.appspotmail.com,
	vbabka@...e.cz,
	vincent.guittot@...aro.org,
	wangqing7171@...il.com
Subject: Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr_ns

On Tue, 06 Jan 2026 at 19:19, Oleg Nesterov <oleg@...hat.com> wrote:
> This case is not similar. This tsk was found by find_task_by_pid_ns(),
> it must be fully initialized.
> 
> So I don't think it makes sense to add the additional check into
> __task_pid_nr_ns().

I agree with this. Let's make an new patch.

> > --- a/kernel/pid.c
> > +++ b/kernel/pid.c
> > @@ -515,7 +515,7 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
> >         rcu_read_lock();
> >         if (!ns)
> >                 ns = task_active_pid_ns(current);
> > -       if (ns)
> > +       if (ns && pid_alive(task))
> 
> This reminds me... the 2nd "if (ns) check must die. I'll ping Cristian.
> See https://lore.kernel.org/all/20251015123613.GA9456@redhat.com/

I viewed this link. Your patches is not merged on master.