[PATCH v2] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
From: alexjlzheng
Date: Wed Jan 28 2026 - 03:31:48 EST
From: Jinliang Zheng <alexjlzheng@xxxxxxxxxxx>
When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent
without proper RCU protection, which leads:
cpu 0 cpu 1
----- -----
do_task_stat
var = task->real_parent
release_task
call_rcu(delayed_put_task_struct)
task_tgid_nr_ns(var)
rcu_read_lock <--- Too late to protect task->real_parent!
task_pid_ptr <--- UAF!
rcu_read_unlock
This patch use task_ppid_nr_ns() instead of task_tgid_nr_ns() to adds
proper RCU protection for accessing task->real_parent.
Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()")
Signed-off-by: Jinliang Zheng <alexjlzheng@xxxxxxxxxxx>
---
changelog:
v2: - use task_ppid_nr_ns(), suggested by Oleg Nesterov
- clear commit message
v1: https://lore.kernel.org/linux-fsdevel/20260127150450.2073236-1-alexjlzheng@xxxxxxxxxxx/
---
fs/proc/array.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 42932f88141a..5571177e0435 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -528,7 +528,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
}
sid = task_session_nr_ns(task, ns);
- ppid = task_tgid_nr_ns(task->real_parent, ns);
+ ppid = task_ppid_nr_ns(task, ns);
pgid = task_pgrp_nr_ns(task, ns);
unlock_task_sighand(task, &flags);
--
2.49.0