bpf: keep a reference to the mm, in case the task is dead.
authorKui-Feng Lee <kuifeng@meta.com>
Fri, 16 Dec 2022 22:18:54 +0000 (14:18 -0800)
committerAlexei Starovoitov <ast@kernel.org>
Wed, 28 Dec 2022 22:11:48 +0000 (14:11 -0800)
commit7ff94f276f8ea05df82eb115225e9b26f47a3347
tree66ab8a720acbe92e8d791ad5ae383d9ed6fce1fe
parent8f161ca1105a6af6614333f13aa7be4aab8b633a
bpf: keep a reference to the mm, in case the task is dead.

Fix the system crash that happens when a task iterator travel through
vma of tasks.

In task iterators, we used to access mm by following the pointer on
the task_struct; however, the death of a task will clear the pointer,
even though we still hold the task_struct.  That can cause an
unexpected crash for a null pointer when an iterator is visiting a
task that dies during the visit.  Keeping a reference of mm on the
iterator ensures we always have a valid pointer to mm.

Co-developed-by: Song Liu <song@kernel.org>
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Kui-Feng Lee <kuifeng@meta.com>
Reported-by: Nathan Slingerland <slinger@meta.com>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/r/20221216221855.4122288-2-kuifeng@meta.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/task_iter.c