Re: [PATCH] fork/pid: Fix use-after-free in __task_pid_nr_ns

[Qing Wang]

On Tue, 06 Jan 2026 at 19:19, Oleg Nesterov <oleg@xxxxxxxxxx> wrote:
> This case is not similar. This tsk was found by find_task_by_pid_ns(),
> it must be fully initialized.
> 
> So I don't think it makes sense to add the additional check into
> __task_pid_nr_ns().

I agree with this. Let's make an new patch.

> > --- a/kernel/pid.c
> > +++ b/kernel/pid.c
> > @@ -515,7 +515,7 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
> >         rcu_read_lock();
> >         if (!ns)
> >                 ns = task_active_pid_ns(current);
> > -       if (ns)
> > +       if (ns && pid_alive(task))
> 
> This reminds me... the 2nd "if (ns) check must die. I'll ping Cristian.
> See https://lore.kernel.org/all/20251015123613.GA9456@xxxxxxxxxx/

I viewed this link. Your patches is not merged on master.