Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr_ns

[Oleg Nesterov <oleg@redhat.com>]

On 01/06, Qing Wang wrote:
>
> Could we put the checking 'pid_alive(task)' into __task_pid_nr_ns()?

I don't think so... see below.

> Because there is another similar use case here.
>
>
> arch/s390/kernel/perf_cpum_sf.c
>   619,9: 		pid = __task_pid_nr_ns(tsk, type, event->ns);

This case is not similar. This tsk was found by find_task_by_pid_ns(),
it must be fully initialized.

So I don't think it makes sense to add the additional check into
__task_pid_nr_ns().

> --- a/kernel/pid.c
> +++ b/kernel/pid.c
> @@ -515,7 +515,7 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
>         rcu_read_lock();
>         if (!ns)
>                 ns = task_active_pid_ns(current);
> -       if (ns)
> +       if (ns && pid_alive(task))

This reminds me... the 2nd "if (ns) check must die. I'll ping Cristian.
See https://lore.kernel.org/all/20251015123613.GA9456@redhat.com/

Oleg.