[PATCH bpf-next 0/2] bpf: fix crash in bpf_path_d_path() for exiting tasks

[Matt Bobrowski <matt@bobrowski.net>]

bpf_path_d_path() can run on a file released from exit_task_work(),
after exit_fs() has cleared the task's fs, as a BPF LSM program attached
to file_release does whenever a task exits holding the last reference to
an open file. d_path() then dereferences the NULL fs.

Patch 1 returns -EINVAL from bpf_path_d_path() when current->fs is NULL.
Patch 2 adds a selftest that crashes the kernel without it.

Matt Bobrowski (2):
  bpf: fix crash in bpf_path_d_path() for exiting tasks
  selftests/bpf: test bpf_path_d_path() on a file released at task exit

 fs/bpf_fs_kfuncs.c                            |  8 +++
 .../selftests/bpf/prog_tests/fs_kfuncs.c      | 51 +++++++++++++++++++
 .../selftests/bpf/progs/test_path_d_path.c    | 35 +++++++++++++
 3 files changed, 94 insertions(+)
 create mode 100644 tools/testing/selftests/bpf/progs/test_path_d_path.c


base-commit: 0007654a7bf13ef2a19afd398bbc6507087f19fd
-- 
2.47.3