bpf: keep a reference to the mm, in case the task is dead.
authorKui-Feng Lee <kuifeng@meta.com>
Fri, 16 Dec 2022 22:18:54 +0000 (14:18 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 24 Jan 2023 06:24:31 +0000 (07:24 +0100)
commit6c27fc15747967e350fa9f253a034ff03e943ccf
tree726cf6520211a8abb64e52aeb80aecfa876981cd
parentaf0bedfbcb81412bb95738937267744f45358dee
bpf: keep a reference to the mm, in case the task is dead.

[ Upstream commit 7ff94f276f8ea05df82eb115225e9b26f47a3347 ]

Fix the system crash that happens when a task iterator travel through
vma of tasks.

In task iterators, we used to access mm by following the pointer on
the task_struct; however, the death of a task will clear the pointer,
even though we still hold the task_struct.  That can cause an
unexpected crash for a null pointer when an iterator is visiting a
task that dies during the visit.  Keeping a reference of mm on the
iterator ensures we always have a valid pointer to mm.

Co-developed-by: Song Liu <song@kernel.org>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Kui-Feng Lee <kuifeng@meta.com>
Reported-by: Nathan Slingerland <slinger@meta.com>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20221216221855.4122288-2-kuifeng@meta.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/bpf/task_iter.c