Re: [syzbot] [mptcp?] general protection fault in proc_scheduler

Hillf Danton
2025-01-03T10:33:14Z

On Thu, Jan 2, 2025 at 3:12 PM syzbot
> syzbot found the following issue on:
>
> HEAD commit: ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g..
> git tree: upstream
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1245eaf8580000

#syz test

--- x/net/mptcp/ctrl.c
+++ y/net/mptcp/ctrl.c
@@ -122,7 +122,7 @@ static int mptcp_set_scheduler(const str
static int proc_scheduler(const struct ctl_table *ctl, int write,
void *buffer, size_t *lenp, loff_t *ppos)
{
- const struct net *net = current->nsproxy->net_ns;
+ const struct net *net;
char val[MPTCP_SCHED_NAME_MAX];
struct ctl_table tbl = {
.data = val,
@@ -130,6 +130,9 @@ static int proc_scheduler(const struct c
};
int ret;

+ if (current->flags & PF_EXITING)
+ return -ENXIO;
+ net = current->nsproxy->net_ns;
strscpy(val, mptcp_get_scheduler(net), MPTCP_SCHED_NAME_MAX);

ret = proc_dostring(&tbl, write, buffer, lenp, ppos);
@@ -161,9 +164,12 @@ static int proc_blackhole_detect_timeout
int write, void *buffer, size_t *lenp,
loff_t *ppos)
{
- struct mptcp_pernet *pernet = mptcp_get_pernet(current->nsproxy->net_ns);
+ struct mptcp_pernet *pernet;
int ret;

+ if (current->flags & PF_EXITING)
+ return -ENXIO;
+ pernet = mptcp_get_pernet(current->nsproxy->net_ns);
ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
if (write && ret == 0)
atomic_set(&pernet->active_disable_times, 0);
--