pidfs: check for valid pid namespace

When we access a no-current task's pid namespace we need check that the
task hasn't been reaped in the meantime and it's pid namespace isn't
accessible anymore.

The user namespace is fine because it is only released when the last
reference to struct task_struct is put and exit_creds() is called.

Link: https://lore.kernel.org/r/20240926-klebt-altgedienten-0415ad4d273c@brauner
Fixes: 5b08bd408534 ("pidfs: allow retrieval of namespace file descriptors")
CC: stable@vger.kernel.org # v6.11
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/pidfs.c b/fs/pidfs.c
index 7ffdc88dfb527d9cf8a133955c9379f8f89a1788..80675b6bf88459c22787edaa68db360bdc0d0782 100644 (file)
--- a/fs/pidfs.c
+++ b/fs/pidfs.c
@@ -120,6 +120,7 @@ static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        struct nsproxy *nsp __free(put_nsproxy) = NULL;
        struct pid *pid = pidfd_pid(file);
        struct ns_common *ns_common = NULL;
+       struct pid_namespace *pid_ns;
 
        if (arg)
                return -EINVAL;
@@ -202,7 +203,9 @@ static long pidfd_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
        case PIDFD_GET_PID_NAMESPACE:
                if (IS_ENABLED(CONFIG_PID_NS)) {
                        rcu_read_lock();
-                       ns_common = to_ns_common( get_pid_ns(task_active_pid_ns(task)));
+                       pid_ns = task_active_pid_ns(task);
+                       if (pid_ns)
+                               ns_common = to_ns_common(get_pid_ns(pid_ns));
                        rcu_read_unlock();
                }
                break;