Re: [syzbot] [mptcp?] general protection fault in proc_scheduler

[Hillf Danton <hdanton@sina.com>]

On Thu, Jan 2, 2025 at 3:12 PM syzbot
> syzbot found the following issue on:
>
> HEAD commit:    ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
> git tree:       upstream
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1245eaf8580000

#syz test

--- x/net/mptcp/ctrl.c
+++ y/net/mptcp/ctrl.c
@@ -122,7 +122,7 @@ static int mptcp_set_scheduler(const str
 static int proc_scheduler(const struct ctl_table *ctl, int write,
 			  void *buffer, size_t *lenp, loff_t *ppos)
 {
-	const struct net *net = current->nsproxy->net_ns;
+	const struct net *net;
 	char val[MPTCP_SCHED_NAME_MAX];
 	struct ctl_table tbl = {
 		.data = val,
@@ -130,6 +130,9 @@ static int proc_scheduler(const struct c
 	};
 	int ret;
 
+	if (current->flags & PF_EXITING)
+		return -ENXIO;
+	net = current->nsproxy->net_ns;
 	strscpy(val, mptcp_get_scheduler(net), MPTCP_SCHED_NAME_MAX);
 
 	ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
@@ -161,9 +164,12 @@ static int proc_blackhole_detect_timeout
 					 int write, void *buffer, size_t *lenp,
 					 loff_t *ppos)
 {
-	struct mptcp_pernet *pernet = mptcp_get_pernet(current->nsproxy->net_ns);
+	struct mptcp_pernet *pernet;
 	int ret;
 
+	if (current->flags & PF_EXITING)
+		return -ENXIO;
+	pernet = mptcp_get_pernet(current->nsproxy->net_ns);
 	ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
 	if (write && ret == 0)
 		atomic_set(&pernet->active_disable_times, 0);
--