* Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr_ns
[not found] <20260105045609.1764387-1-wangqing7171@gmail.com>
@ 2026-01-07 20:39 ` Kees Cook
2026-01-08 2:15 ` Qing Wang
2026-01-08 3:44 ` Qing Wang
0 siblings, 2 replies; 3+ messages in thread
From: Kees Cook @ 2026-01-07 20:39 UTC (permalink / raw)
To: Qing Wang
Cc: Andrew Morton, David Hildenbrand, Lorenzo Stoakes,
Liam R . Howlett, Vlastimil Babka, Mike Rapoport,
Suren Baghdasaryan, Michal Hocko, Ingo Molnar, Peter Zijlstra,
Juri Lelli, Vincent Guittot, Dietmar Eggemann, Steven Rostedt,
Ben Segall, Mel Gorman, Valentin Schneider, linux-mm,
linux-kernel, syzbot+e0378d4f4fe57aa2bdd0
On Mon, Jan 05, 2026 at 12:56:09PM +0800, Qing Wang wrote:
> Syzbot reported a slab-use-after-free issue in __task_pid_nr_ns:
>
> BUG: KASAN: slab-use-after-free in __task_pid_nr_ns+0x1e4/0x490...
> Read of size 8 at addr ffff88807f8058a8 by task syz.1.574/8108
>
> The race condition occurs between the failure path of copy_process() and
> getting the PIDTYPE_TGID via __task_pid_nr_ns().
>
> Bug timeline:
> Task B
> perf_event_open()
> Task A <--------------------------- clone()
> copy_process()
> perf_event_init_task()
> ...
> one copy failed
> free_signal_struct() close(event_fd)
> perf_child_detach()
> __task_pid_nr_ns()
> access child task->signal
>
> This is fixed by:
> 1. Setting task->signal = NULL in the failure cleanup path of copy_process.
> 2. Adding a null check for task->signal before accessing PIDTYPE_TGID from
> task->signal.
>
> Note: This bug was reported by syzbot without a reproducer.
> The fix is based on code inspection and race condition analysis.
It seems like there is synchronization missing between the task->signal
assignment and its check in task_pid_ptr? Aren't there other ways of
checking if a task is dead? This change doesn't look right to me...
-Kees
>
> Reported-by: syzbot+e0378d4f4fe57aa2bdd0@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=e0378d4f4fe57aa2bdd0
> Signed-off-by: Qing Wang <wangqing7171@gmail.com>
> ---
> kernel/fork.c | 8 ++++++--
> kernel/pid.c | 6 +++---
> 2 files changed, 9 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/fork.c b/kernel/fork.c
> index b1f3915d5f8e..72b9b37a96c8 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
> @@ -1975,6 +1975,7 @@ __latent_entropy struct task_struct *copy_process(
> struct file *pidfile = NULL;
> const u64 clone_flags = args->flags;
> struct nsproxy *nsp = current->nsproxy;
> + struct signal_struct *free_sig = NULL;
>
> /*
> * Don't allow sharing the root directory with processes in a different
> @@ -2501,8 +2502,11 @@ __latent_entropy struct task_struct *copy_process(
> mmput(p->mm);
> }
> bad_fork_cleanup_signal:
> - if (!(clone_flags & CLONE_THREAD))
> - free_signal_struct(p->signal);
> + if (!(clone_flags & CLONE_THREAD)) {
> + free_sig = p->signal;
> + p->signal = NULL;
> + free_signal_struct(free_sig);
> + }
> bad_fork_cleanup_sighand:
> __cleanup_sighand(p->sighand);
> bad_fork_cleanup_fs:
> diff --git a/kernel/pid.c b/kernel/pid.c
> index a31771bc89c1..1a012e033552 100644
> --- a/kernel/pid.c
> +++ b/kernel/pid.c
> @@ -329,9 +329,9 @@ EXPORT_SYMBOL_GPL(find_vpid);
>
> static struct pid **task_pid_ptr(struct task_struct *task, enum pid_type type)
> {
> - return (type == PIDTYPE_PID) ?
> - &task->thread_pid :
> - &task->signal->pids[type];
> + if (type == PIDTYPE_PID)
> + return &task->thread_pid;
> + return task->signal ? &task->signal->pids[type] : NULL;
> }
>
> /*
> --
> 2.34.1
>
--
Kees Cook
^ permalink raw reply [flat|nested] 3+ messages in thread