linux-kernel - Re: [PATCH v2] procfs: fix missing RCU protection when reading real_parent in do_task

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aXnNa2jymiJYjzij@redhat.com>
Date: Wed, 28 Jan 2026 09:48:43 +0100
From: Oleg Nesterov <oleg@...hat.com>
To: alexjlzheng@...il.com
Cc: usamaarif642@...il.com, david@...nel.org, akpm@...ux-foundation.org,
	lorenzo.stoakes@...cle.com, mingo@...nel.org,
	alexjlzheng@...cent.com, ruippan@...cent.com, mjguzik@...il.com,
	linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH v2] procfs: fix missing RCU protection when reading
 real_parent in do_task_stat()

On 01/28, alexjlzheng@...il.com wrote:
>
> From: Jinliang Zheng <alexjlzheng@...cent.com>
>
> When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent
> without proper RCU protection, which leads:
>
>   cpu 0                               cpu 1
>   -----                               -----
>   do_task_stat
>     var = task->real_parent
>                                       release_task
>                                         call_rcu(delayed_put_task_struct)
>     task_tgid_nr_ns(var)
>       rcu_read_lock   <--- Too late to protect task->real_parent!
>       task_pid_ptr    <--- UAF!
>       rcu_read_unlock
>
> This patch use task_ppid_nr_ns() instead of task_tgid_nr_ns() to adds
> proper RCU protection for accessing task->real_parent.
>
> Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()")
> Signed-off-by: Jinliang Zheng <alexjlzheng@...cent.com>

Acked-by: Oleg Nesterov <oleg@...hat.com>