tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

proc: fix the issue of proc_mem_open returning NULL

proc_mem_open() can return an errno, NULL, or mm_struct*. If it fails to
acquire mm, it returns NULL, but the caller does not check for the case
when the return value is NULL.

The following conditions lead to failure in acquiring mm:

- The task is a kernel thread (PF_KTHREAD)
- The task is exiting (PF_EXITING)

Changes:

- Add documentation comments for the return value of proc_mem_open().
- Add checks in the caller to return -ESRCH when proc_mem_open()
returns NULL.

Link: https://lkml.kernel.org/r/20250404063357.78891-1-superman.xpt@gmail.com
Reported-by: syzbot+f9238a0a31f9b5603fef@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000f52642060d4e3750@google.com
Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Adrian Ratiu <adrian.ratiu@collabora.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Felix Moessbauer <felix.moessbauer@siemens.com>
Cc: Jeff layton <jlayton@kernel.org>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: xu xin <xu.xin16@zte.com.cn>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Penglei Jiang and committed by
Andrew Morton 65c66047 3dfd79cc

+17 -11
+9 -3
fs/proc/base.c
··· 827 827 .release = single_release, 828 828 }; 829 829 830 - 830 + /* 831 + * proc_mem_open() can return errno, NULL or mm_struct*. 832 + * 833 + * - Returns NULL if the task has no mm (PF_KTHREAD or PF_EXITING) 834 + * - Returns mm_struct* on success 835 + * - Returns error code on failure 836 + */ 831 837 struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) 832 838 { 833 839 struct task_struct *task = get_proc_task(inode); ··· 860 854 { 861 855 struct mm_struct *mm = proc_mem_open(inode, mode); 862 856 863 - if (IS_ERR(mm)) 864 - return PTR_ERR(mm); 857 + if (IS_ERR_OR_NULL(mm)) 858 + return mm ? PTR_ERR(mm) : -ESRCH; 865 859 866 860 file->private_data = mm; 867 861 return 0;
+6 -6
fs/proc/task_mmu.c
··· 212 212 213 213 priv->inode = inode; 214 214 priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); 215 - if (IS_ERR(priv->mm)) { 216 - int err = PTR_ERR(priv->mm); 215 + if (IS_ERR_OR_NULL(priv->mm)) { 216 + int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH; 217 217 218 218 seq_release_private(inode, file); 219 219 return err; ··· 1325 1325 1326 1326 priv->inode = inode; 1327 1327 priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); 1328 - if (IS_ERR(priv->mm)) { 1329 - ret = PTR_ERR(priv->mm); 1328 + if (IS_ERR_OR_NULL(priv->mm)) { 1329 + ret = priv->mm ? PTR_ERR(priv->mm) : -ESRCH; 1330 1330 1331 1331 single_release(inode, file); 1332 1332 goto out_free; ··· 2069 2069 struct mm_struct *mm; 2070 2070 2071 2071 mm = proc_mem_open(inode, PTRACE_MODE_READ); 2072 - if (IS_ERR(mm)) 2073 - return PTR_ERR(mm); 2072 + if (IS_ERR_OR_NULL(mm)) 2073 + return mm ? PTR_ERR(mm) : -ESRCH; 2074 2074 file->private_data = mm; 2075 2075 return 0; 2076 2076 }
+2 -2
fs/proc/task_nommu.c
··· 260 260 261 261 priv->inode = inode; 262 262 priv->mm = proc_mem_open(inode, PTRACE_MODE_READ); 263 - if (IS_ERR(priv->mm)) { 264 - int err = PTR_ERR(priv->mm); 263 + if (IS_ERR_OR_NULL(priv->mm)) { 264 + int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH; 265 265 266 266 seq_release_private(inode, file); 267 267 return err;