Re: kernel: signal: NULL ptr deref when killing process

[David Howells]

Oleg Nesterov <oleg@xxxxxxxxxx> wrote:

> David, any other reason why ->real_cred can be NULL ? (assuming that I
> interpret this asm correctly).

It should only be possible to see ->real_cred as being NULL after exit_creds()
has been called from __put_task_struct() for a task that has finished
construction.

It shouldn't be possible to introduce a NULL pointer through commit_creds() or
override_creds() since both of those should crash immediately if given one,
but it's possible revert_creds() could be so used.

Is there a race between kill() and exit() brought on by the kill path only
using the RCU read lock?  This doesn't prevent ->real_cred from being
modified, but it looks like this should, in combination with
delayed_put_task_struct(), prevent it from being cleared.

David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/