[PATCH] pid: handle a NULL dereference error case in find_task_by_pid_ns

[Sung-hun Kim]

A NULL dereference error is occurred when find_task_by_pid_ns is
called with a 'ns' argument which value is NULL. This situation
is incurred when the kernel tries to call find_task_by_pid_ns in
the process context which is in exiting. This is because, when
the process is exiting, it detaches its struct pid from the
task_struct. The function find_task_by_vpid, one of callers of
find_task_by_pid_ns, takes the result of task_active_pid_ns(current)
as an argument. But, task_active_pid_ns returns NULL if the
current process is in exiting. So, the kernel incurs a NULL
dereference error since find_task_by_pid_ns uses the argument
without NULL check.

This patch adds a NULL check routine in find_task_by_pid_ns. The
function returns NULL when NULL is given as an argument.

Signed-off-by: Sung-hun Kim <sfoon.kim@xxxxxxxxxxx>
---
 kernel/pid.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/pid.c b/kernel/pid.c
index 3fbc5e46b721..914aebe9fee8 100644
--- a/kernel/pid.c
+++ b/kernel/pid.c
@@ -412,9 +412,12 @@ EXPORT_SYMBOL(pid_task);
  */
 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
 {
+	struct task_struct *task = NULL;
 	RCU_LOCKDEP_WARN(!rcu_read_lock_held(),
 			 "find_task_by_pid_ns() needs rcu_read_lock() protection");
-	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
+	if (likely(ns))
+		task = pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
+	return task;
 }
 
 struct task_struct *find_task_by_vpid(pid_t vnr)
-- 
2.17.1