Artem Fetishev <artem_fetishev@xxxxxxxx> writes: > https://bugzilla.kernel.org/show_bug.cgi?id=68991 > > The expected logic of proc_map_files_get_link() is either to return 0 and > initialize 'path' or return an error and leave 'path' uninitialized. By the time > dname_to_vma_addr() returns 0 the corresponding vma may have already be gone. In > this case the path is not initialized but the return value is still 0. This > results in 'general protection fault' inside d_path(). > > Steps to reproduce: > CONFIG_CHECKPOINT_RESTORE=y > > fd = open(...); > while (1) { > mmap(fd, ...); > munmap(fd, ...); > } > > ls -la /proc/$PID/map_files > > Signed-off-by: Artem Fetishev <artem_fetishev@xxxxxxxx> > Signed-off-by: Aleksandr Terekhov <aleksandr_terekhov@xxxxxxxx> Reviewed-by: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx> > --- > diff --git a/fs/proc/base.c b/fs/proc/base.c > index 5150706..b976062 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -1824,6 +1824,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path) > if (rc) > goto out_mmput; > > + rc = -ENOENT; > down_read(&mm->mmap_sem); > vma = find_exact_vma(mm, vm_start, vm_end); > if (vma && vma->vm_file) { > _______________________________________________ > Containers mailing list > Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx > https://lists.linuxfoundation.org/mailman/listinfo/containers _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
