proc: fix the issue of proc_mem_open returning NULL

proc_mem_open() can return an errno, NULL, or mm_struct*.  If it fails to
acquire mm, it returns NULL, but the caller does not check for the case
when the return value is NULL.

The following conditions lead to failure in acquiring mm:

  - The task is a kernel thread (PF_KTHREAD)
  - The task is exiting (PF_EXITING)

Changes:

  - Add documentation comments for the return value of proc_mem_open().
  - Add checks in the caller to return -ESRCH when proc_mem_open()
    returns NULL.

Link: https://lkml.kernel.org/r/20250404063357.78891-1-superman.xpt@gmail.com
Reported-by: syzbot+f9238a0a31f9b5603fef@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000f52642060d4e3750@google.com
Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Adrian Ratiu <adrian.ratiu@collabora.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Felix Moessbauer <felix.moessbauer@siemens.com>
Cc: Jeff layton <jlayton@kernel.org>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Cc: Thomas Gleinxer <tglx@linutronix.de>
Cc: xu xin <xu.xin16@zte.com.cn>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/fs/proc/base.c b/fs/proc/base.c
index b0d4e1908b22fc4147e86a3abea0905610ee833b..85a3f5e253d4dd87e77282cb9315e93511ba15b3 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -827,7 +827,13 @@ static const struct file_operations proc_single_file_operations = {
        .release        = single_release,
 };
 
-
+/*
+ * proc_mem_open() can return errno, NULL or mm_struct*.
+ *
+ *   - Returns NULL if the task has no mm (PF_KTHREAD or PF_EXITING)
+ *   - Returns mm_struct* on success
+ *   - Returns error code on failure
+ */
 struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
 {
        struct task_struct *task = get_proc_task(inode);
@@ -854,8 +860,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
 {
        struct mm_struct *mm = proc_mem_open(inode, mode);
 
-       if (IS_ERR(mm))
-               return PTR_ERR(mm);
+       if (IS_ERR_OR_NULL(mm))
+               return mm ? PTR_ERR(mm) : -ESRCH;
 
        file->private_data = mm;
        return 0;

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 994cde10e3f4d327b349e98a1a30519872f90f4e..b9e3bd006346dc947c1971af1c8bd6ac3630acd3 100644 (file)
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -212,8 +212,8 @@ static int proc_maps_open(struct inode *inode, struct file *file,
 
        priv->inode = inode;
        priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-       if (IS_ERR(priv->mm)) {
-               int err = PTR_ERR(priv->mm);
+       if (IS_ERR_OR_NULL(priv->mm)) {
+               int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
                seq_release_private(inode, file);
                return err;
@@ -1325,8 +1325,8 @@ static int smaps_rollup_open(struct inode *inode, struct file *file)
 
        priv->inode = inode;
        priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-       if (IS_ERR(priv->mm)) {
-               ret = PTR_ERR(priv->mm);
+       if (IS_ERR_OR_NULL(priv->mm)) {
+               ret = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
                single_release(inode, file);
                goto out_free;
@@ -2069,8 +2069,8 @@ static int pagemap_open(struct inode *inode, struct file *file)
        struct mm_struct *mm;
 
        mm = proc_mem_open(inode, PTRACE_MODE_READ);
-       if (IS_ERR(mm))
-               return PTR_ERR(mm);
+       if (IS_ERR_OR_NULL(mm))
+               return mm ? PTR_ERR(mm) : -ESRCH;
        file->private_data = mm;
        return 0;
 }

diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index bce6745330003174ed2161e31978377477cfbd70..59bfd61d653aaead0d06ce601b3685c1c6c12992 100644 (file)
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -260,8 +260,8 @@ static int maps_open(struct inode *inode, struct file *file,
 
        priv->inode = inode;
        priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-       if (IS_ERR(priv->mm)) {
-               int err = PTR_ERR(priv->mm);
+       if (IS_ERR_OR_NULL(priv->mm)) {
+               int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
                seq_release_private(inode, file);
                return err;