From: Leon Hwang <leon.hwang@linux.dev>
To: Sechang Lim <rhkrqnwk98@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
Juntong Deng <juntong.deng@outlook.com>,
bpf@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH bpf v4] bpf: fix NULL pointer dereference in bpf_task_from_vpid()
Date: Mon, 8 Jun 2026 13:42:08 +0800 [thread overview]
Message-ID: <b89c1f53-2ba8-4b70-9058-fcc59eda40d7@linux.dev> (raw)
In-Reply-To: <20260608050001.2545245-1-rhkrqnwk98@gmail.com>
On 8/6/26 13:00, Sechang Lim wrote:
> bpf_task_from_vpid() looks up a task in the pid namespace of the
> current task, via find_task_by_vpid():
>
> find_task_by_vpid(vpid)
> find_task_by_pid_ns(vpid, task_active_pid_ns(current))
> find_pid_ns(nr, ns) -> idr_find(&ns->idr, nr)
>
> cgroup_skb programs run in softirq, which may interrupt a task that is
> itself in do_exit(). Once that task has passed
> exit_notify() -> release_task() -> __unhash_process(), its thread_pid is
> cleared, so task_active_pid_ns(current) returns NULL and find_pid_ns()
> dereferences &NULL->idr:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000050
> RIP: 0010:idr_find+0x11/0x30 lib/idr.c:176
> Call Trace:
> <IRQ>
> find_pid_ns kernel/pid.c:370 [inline]
> find_task_by_pid_ns+0x3b/0xe0 kernel/pid.c:485
> bpf_task_from_vpid+0x5b/0x200 kernel/bpf/helpers.c:2916
> bpf_prog_run_array_cg+0x17e/0x530 kernel/bpf/cgroup.c:81
> __cgroup_bpf_run_filter_skb+0x12b/0x250 kernel/bpf/cgroup.c:1612
> sk_filter_trim_cap+0x1dc/0x4c0 net/core/filter.c:148
> tcp_v4_rcv+0x18d1/0x2200 net/ipv4/tcp_ipv4.c:2223
> </IRQ>
> <TASK>
> do_exit+0xa63/0x1270 kernel/exit.c:1010
> get_signal+0x141c/0x1530 kernel/signal.c:3037
>
> Bail out when current has no pid namespace.
>
> Fixes: 675c3596ff32 ("bpf: Add bpf_task_from_vpid() kfunc")
> Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
> ---
> v4:
> - Drop the in_interrupt() check. (Kumar Kartikeya Dwivedi)
> - Switch to guard(rcu)() and drop the explicit rcu_read_unlock(). (Leon
> Hwang)
>
LGTM:
Acked-by: Leon Hwang <leon.hwang@linux.dev>
next prev parent reply other threads:[~2026-06-08 5:42 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-08 5:00 Sechang Lim
2026-06-08 5:42 ` Leon Hwang [this message]
2026-06-08 12:00 ` patchwork-bot+netdevbpf
2026-06-09 7:32 ` abaci-kreproducer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=b89c1f53-2ba8-4b70-9058-fcc59eda40d7@linux.dev \
--to=leon.hwang@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=jolsa@kernel.org \
--cc=juntong.deng@outlook.com \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=rhkrqnwk98@gmail.com \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox