From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail115-79.sinamail.sina.com.cn (mail115-79.sinamail.sina.com.cn [218.30.115.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D0FD59B71 for ; Fri, 3 Jan 2025 10:33:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=218.30.115.79 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735900399; cv=none; b=RJS39iPzTZX/7JSv3pX+SX6YA53o0k/o14ULFXDEMIU8bf0hgdMtiNDR8JZFYoBnfNz6UeRcdRQ19Bw5R/G9rUh/WuK/LxoPjiiZAEq29Gm9glYXqnel7YQNnRlRyCn+1JT2HGPZzzLYxgZaJwgCfWaySdqHB7+RuBaCHyS7kcU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1735900399; c=relaxed/simple; bh=83mqAcC/m8pn13WLmRYGGPUumCkwsV9DRV3eb+PlLhU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ndK3320v0S16Z/zE3gxaoCqpVWRMx71j5PPQhxLMd+vHtUH0xzytKHsfx4baeBGMBGNh0DnNG/x3rC2HsNZoIY4Lfyi6cW1hj0ZkwJDMSfYH/1jmtdyF71aT431zPJxa7fOo6m4J7bUkk6Acz6DSds/ioZznicNwkp7dAdDupoc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; arc=none smtp.client-ip=218.30.115.79 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([113.118.68.213]) by sina.com (10.185.250.22) with ESMTP id 6777BCE000006775; Fri, 3 Jan 2025 18:33:06 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 337337602577 X-SMAIL-UIID: A02F1EB3A6E043AFBD9EE7AF3BE1E336-20250103-183306-1 From: Hillf Danton To: syzbot Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [mptcp?] general protection fault in proc_scheduler Date: Fri, 3 Jan 2025 18:32:52 +0800 Message-ID: <20250103103255.1309-1-hdanton@sina.com> In-Reply-To: <67769ecb.050a0220.3a8527.003f.GAE@google.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On Thu, Jan 2, 2025 at 3:12 PM syzbot > syzbot found the following issue on: > > HEAD commit: ccb98ccef0e5 Merge tag 'platform-drivers-x86-v6.13-4' of g.. > git tree: upstream > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1245eaf8580000 #syz test --- x/net/mptcp/ctrl.c +++ y/net/mptcp/ctrl.c @@ -122,7 +122,7 @@ static int mptcp_set_scheduler(const str static int proc_scheduler(const struct ctl_table *ctl, int write, void *buffer, size_t *lenp, loff_t *ppos) { - const struct net *net = current->nsproxy->net_ns; + const struct net *net; char val[MPTCP_SCHED_NAME_MAX]; struct ctl_table tbl = { .data = val, @@ -130,6 +130,9 @@ static int proc_scheduler(const struct c }; int ret; + if (current->flags & PF_EXITING) + return -ENXIO; + net = current->nsproxy->net_ns; strscpy(val, mptcp_get_scheduler(net), MPTCP_SCHED_NAME_MAX); ret = proc_dostring(&tbl, write, buffer, lenp, ppos); @@ -161,9 +164,12 @@ static int proc_blackhole_detect_timeout int write, void *buffer, size_t *lenp, loff_t *ppos) { - struct mptcp_pernet *pernet = mptcp_get_pernet(current->nsproxy->net_ns); + struct mptcp_pernet *pernet; int ret; + if (current->flags & PF_EXITING) + return -ENXIO; + pernet = mptcp_get_pernet(current->nsproxy->net_ns); ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); if (write && ret == 0) atomic_set(&pernet->active_disable_times, 0); --