pid_namespace: pidns_get() should check task_active_pid_ns() != NULL

commit d23082257d83e4bc89727d5aedee197e907999d2 upstream.

pidns_get()->get_pid_ns() can hit ns == NULL. This task_struct can't
go away, but task_active_pid_ns(task) is NULL if release_task(task)
was already called. Alternatively we could change get_pid_ns(ns) to
check ns != NULL, but it seems that other callers are fine.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: Eric W. Biederman ebiederm@xmission.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
index 6917e8edb48e7702714041737657f1e3949bc849..e32703d5e0ab7c05083efb1eef9a67ad40fa0f2c 100644 (file)
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -312,7 +312,9 @@ static void *pidns_get(struct task_struct *task)
        struct pid_namespace *ns;
 
        rcu_read_lock();
-       ns = get_pid_ns(task_active_pid_ns(task));
+       ns = task_active_pid_ns(task);
+       if (ns)
+               get_pid_ns(ns);
        rcu_read_unlock();
 
        return ns;