Re: kernel: signal: NULL ptr deref when killing process

[Oleg Nesterov <oleg@redhat.com>]

On 08/21, David Howells wrote:
>
> Oleg Nesterov <oleg@redhat.com> wrote:
>
> > David, any other reason why ->real_cred can be NULL ? (assuming that I
> > interpret this asm correctly).
>
> It should only be possible to see ->real_cred as being NULL after exit_creds()
> has been called from __put_task_struct() for a task that has finished
> construction.

Yes, thanks, this was my understanding...

> Is there a race between kill() and exit() brought on by the kill path only
> using the RCU read lock?  This doesn't prevent ->real_cred from being
> modified, but it looks like this should, in combination with
> delayed_put_task_struct(), prevent it from being cleared.

Yes, rcu should protect us from both delayed_put_pid() and delayed_put_task().
Everything looks correct... And there are a lot of other similar users of
find_vpid/find_task_by_vpid/pid_task/etc under rcu, I can't recall any bug
in this area.

I am puzzled. Note also that ->signal == NULL. Will try to think more,
but so far I have no any idea.

Oleg.