1. Patchew
  2. linux
  3. View series

[PATCH] proc: Fix the issue of proc_mem_open returning NULL

Penglei Jiang posted 1 patch 8 months, 4 weeks ago
There is a newer version of this series
fs/proc/base.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] proc: Fix the issue of proc_mem_open returning NULL
Posted by Penglei Jiang 8 months, 4 weeks ago 
The following functions call proc_mem_open but do not handle the case
where it returns NULL:

  __mem_open in fs/proc/base.c
  proc_maps_open in fs/proc/task_mmu.c
  smaps_rollup_open in fs/proc/task_mmu.c
  pagemap_open in fs/proc/task_mmu.c
  maps_open in fs/proc/task_nommu.c

The following reported bugs may be related to this issue:

  https://lore.kernel.org/all/000000000000f52642060d4e3750@google.com
  https://lore.kernel.org/all/0000000000001bc4a00612d9a7f4@google.com

Fix:

Modify proc_mem_open to return an error code in case of errors, instead
of returning NULL.

Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
---
 fs/proc/base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index cd89e956c322..b5e7317cf0dc 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -840,7 +840,7 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
 	put_task_struct(task);
 
 	if (IS_ERR(mm))
-		return mm == ERR_PTR(-ESRCH) ? NULL : mm;
+		return mm;
 
 	/* ensure this mm_struct can't be freed */
 	mmgrab(mm);
-- 
2.17.1
Re: [PATCH] proc: Fix the issue of proc_mem_open returning NULL
Posted by Mateusz Guzik 8 months, 4 weeks ago 
On Mon, Mar 24, 2025 at 09:23:53AM -0700, Penglei Jiang wrote:
> The following functions call proc_mem_open but do not handle the case
> where it returns NULL:
> 
>   __mem_open in fs/proc/base.c
>   proc_maps_open in fs/proc/task_mmu.c
>   smaps_rollup_open in fs/proc/task_mmu.c
>   pagemap_open in fs/proc/task_mmu.c
>   maps_open in fs/proc/task_nommu.c
> 
> The following reported bugs may be related to this issue:
> 
>   https://lore.kernel.org/all/000000000000f52642060d4e3750@google.com
>   https://lore.kernel.org/all/0000000000001bc4a00612d9a7f4@google.com
> 
> Fix:
> 
> Modify proc_mem_open to return an error code in case of errors, instead
> of returning NULL.
> 

The rw routines associated with these consumers explictly NULL check
mm, which becomes redundant with the patch.

While I find it fishy that returning NULL was ever a thing to begin
with, it is unclear to me if it can be easily changed now from
userspace-visible behavior standpoint.

I think the best way forward for the time being is to add the missing
NULL checks instead.

> Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
> ---
>  fs/proc/base.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index cd89e956c322..b5e7317cf0dc 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -840,7 +840,7 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
>  	put_task_struct(task);
>  
>  	if (IS_ERR(mm))
> -		return mm == ERR_PTR(-ESRCH) ? NULL : mm;
> +		return mm;
>  
>  	/* ensure this mm_struct can't be freed */
>  	mmgrab(mm);
> -- 
> 2.17.1
>
[PATCH V2] proc: Fix the issue of proc_mem_open returning NULL
Posted by Penglei Jiang 8 months, 4 weeks ago 
Hi, all

On Mon, 24 Mar 2025 18:48:35 +0100, Mateusz Guzik wrote:
> On Mon, Mar 24, 2025 at 09:23:53AM -0700, Penglei Jiang wrote:
> > The following functions call proc_mem_open but do not handle the case
> > where it returns NULL:
> >
> >   __mem_open in fs/proc/base.c
> >   proc_maps_open in fs/proc/task_mmu.c
> >   smaps_rollup_open in fs/proc/task_mmu.c
> >   pagemap_open in fs/proc/task_mmu.c
> >   maps_open in fs/proc/task_nommu.c
> >
> > The following reported bugs may be related to this issue:
> >
> >   https://lore.kernel.org/all/000000000000f52642060d4e3750@google.com
> >   https://lore.kernel.org/all/0000000000001bc4a00612d9a7f4@google.com
> >
> > Fix:
> >
> > Modify proc_mem_open to return an error code in case of errors, instead
> > of returning NULL.
> >
>
> The rw routines associated with these consumers explictly NULL check
> mm, which becomes redundant with the patch.
>
> While I find it fishy that returning NULL was ever a thing to begin
> with, it is unclear to me if it can be easily changed now from
> userspace-visible behavior standpoint.
>
> I think the best way forward for the time being is to add the missing
> NULL checks instead.
>
> > Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
> > ---
> >  fs/proc/base.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/fs/proc/base.c b/fs/proc/base.c
> > index cd89e956c322..b5e7317cf0dc 100644
> > --- a/fs/proc/base.c
> > +++ b/fs/proc/base.c
> > @@ -840,7 +840,7 @@ struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
> >  put_task_struct(task);
> >
> >  if (IS_ERR(mm))
> > -return mm == ERR_PTR(-ESRCH) ? NULL : mm;
> > +return mm;
> >
> >  /* ensure this mm_struct can't be freed */
> >  mmgrab(mm);
> > --
> > 2.17.1
> >

Mateusz Guzik provides valuable suggestions.

Complete the missing NULL checks.

Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
---
 fs/proc/base.c       |  4 ++--
 fs/proc/task_mmu.c   | 12 ++++++------
 fs/proc/task_nommu.c |  4 ++--
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index cd89e956c322..d898cec3ee71 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -854,8 +854,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
 {
 	struct mm_struct *mm = proc_mem_open(inode, mode);
 
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 
 	file->private_data = mm;
 	return 0;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f02cd362309a..14d1d8d3e432 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -212,8 +212,8 @@ static int proc_maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
@@ -1312,8 +1312,8 @@ static int smaps_rollup_open(struct inode *inode, struct file *file)
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		ret = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		ret = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		single_release(inode, file);
 		goto out_free;
@@ -2045,8 +2045,8 @@ static int pagemap_open(struct inode *inode, struct file *file)
 	struct mm_struct *mm;
 
 	mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 	file->private_data = mm;
 	return 0;
 }
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index bce674533000..59bfd61d653a 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -260,8 +260,8 @@ static int maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
-- 
2.17.1
Re: [PATCH V2] proc: Fix the issue of proc_mem_open returning NULL
Posted by Andrew Morton 8 months, 3 weeks ago 
On Mon, 24 Mar 2025 21:14:48 -0700 Penglei Jiang <superman.xpt@gmail.com> wrote:

> > >  if (IS_ERR(mm))
> > > -return mm == ERR_PTR(-ESRCH) ? NULL : mm;
> > > +return mm;
> > >
> > >  /* ensure this mm_struct can't be freed */
> > >  mmgrab(mm);
> > > --
> > > 2.17.1
> > >
> 
> Mateusz Guzik provides valuable suggestions.
> 
> Complete the missing NULL checks.

proc_mem_open() can return errno, NULL or mm_struct*.  It isn't obvious
why.

While you're in there can you please add documentation to
proc_mem_open() which explains its return values?
[PATCH V3] proc: Fix the issue of proc_mem_open returning NULL
Posted by Penglei Jiang 8 months, 3 weeks ago 
On Thu, 27 Mar 2025 12:24:45 -0700 Andrew Morton <akpm@linux-foundation.org> wrote:

> On Mon, 24 Mar 2025 21:14:48 -0700 Penglei Jiang <superman.xpt@gmail.com> wrote:
>
> > > >  if (IS_ERR(mm))
> > > > -return mm == ERR_PTR(-ESRCH) ? NULL : mm;
> > > > +return mm;
> > > >
> > > >  /* ensure this mm_struct can't be freed */
> > > >  mmgrab(mm);
> > > > --
> > > > 2.17.1
> > > >
> >
> > Mateusz Guzik provides valuable suggestions.
> >
> > Complete the missing NULL checks.
>
> proc_mem_open() can return errno, NULL or mm_struct*.  It isn't obvious
> why.
>
> While you're in there can you please add documentation to
> proc_mem_open() which explains its return values?

I apologize for the delayed response.

Add documentation comments to proc_mem_open() and add NULL checks in
several call sites.

Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
---
 fs/proc/base.c       | 12 +++++++++---
 fs/proc/task_mmu.c   | 12 ++++++------
 fs/proc/task_nommu.c |  4 ++--
 3 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 5538c4aee8fa..cbe4e7d557e1 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -827,7 +827,13 @@ static const struct file_operations proc_single_file_operations = {
 	.release	= single_release,
 };
 
-
+/*
+ * proc_mem_open() can return errno, NULL or mm_struct*.
+ *
+ *   - Returns NULL if the task has no mm (task->flags & PF_KTHREAD)
+ *   - Returns mm_struct* on success
+ *   - Returns error code on failure
+ */
 struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
 {
 	struct task_struct *task = get_proc_task(inode);
@@ -854,8 +860,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
 {
 	struct mm_struct *mm = proc_mem_open(inode, mode);
 
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 
 	file->private_data = mm;
 	return 0;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f02cd362309a..14d1d8d3e432 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -212,8 +212,8 @@ static int proc_maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
@@ -1312,8 +1312,8 @@ static int smaps_rollup_open(struct inode *inode, struct file *file)
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		ret = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		ret = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		single_release(inode, file);
 		goto out_free;
@@ -2045,8 +2045,8 @@ static int pagemap_open(struct inode *inode, struct file *file)
 	struct mm_struct *mm;
 
 	mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 	file->private_data = mm;
 	return 0;
 }
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index bce674533000..59bfd61d653a 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -260,8 +260,8 @@ static int maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
-- 
2.17.1
[PATCH V4] proc: Fix the issue of proc_mem_open returning NULL
Posted by Penglei Jiang 8 months, 3 weeks ago 
On Mon, 31 Mar 2025 02:16:35 -0700 Penglei Jiang <superman.xpt@gmail.com> wrote:

> On Thu, 27 Mar 2025 12:24:45 -0700 Andrew Morton <akpm@linux-foundation.org> wrote:
>
> > On Mon, 24 Mar 2025 21:14:48 -0700 Penglei Jiang <superman.xpt@gmail.com> wrote:
> >
> > > > >  if (IS_ERR(mm))
> > > > > -return mm == ERR_PTR(-ESRCH) ? NULL : mm;
> > > > > +return mm;
> > > > >
> > > > >  /* ensure this mm_struct can't be freed */
> > > > >  mmgrab(mm);
> > > > > --
> > > > > 2.17.1
> > > > >
> > >
> > > Mateusz Guzik provides valuable suggestions.
> > >
> > > Complete the missing NULL checks.
> >
> > proc_mem_open() can return errno, NULL or mm_struct*.  It isn't obvious
> > why.
> >
> > While you're in there can you please add documentation to
> > proc_mem_open() which explains its return values?
>
> I apologize for the delayed response.
>
> Add documentation comments to proc_mem_open() and add NULL checks in
> several call sites.

Adjust comments based on the V3 patch.

Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
---
 fs/proc/base.c       | 12 +++++++++---
 fs/proc/task_mmu.c   | 12 ++++++------
 fs/proc/task_nommu.c |  4 ++--
 3 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 5538c4aee8fa..c7619e8ef399 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -827,7 +827,13 @@ static const struct file_operations proc_single_file_operations = {
 	.release	= single_release,
 };
 
-
+/*
+ * proc_mem_open() can return errno, NULL or mm_struct*.
+ *
+ *   - Returns NULL if the task has no mm (PF_KTHREAD or PF_EXITING)
+ *   - Returns mm_struct* on success
+ *   - Returns error code on failure
+ */
 struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
 {
 	struct task_struct *task = get_proc_task(inode);
@@ -854,8 +860,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
 {
 	struct mm_struct *mm = proc_mem_open(inode, mode);
 
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 
 	file->private_data = mm;
 	return 0;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index f02cd362309a..14d1d8d3e432 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -212,8 +212,8 @@ static int proc_maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
@@ -1312,8 +1312,8 @@ static int smaps_rollup_open(struct inode *inode, struct file *file)
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		ret = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		ret = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		single_release(inode, file);
 		goto out_free;
@@ -2045,8 +2045,8 @@ static int pagemap_open(struct inode *inode, struct file *file)
 	struct mm_struct *mm;
 
 	mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 	file->private_data = mm;
 	return 0;
 }
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index bce674533000..59bfd61d653a 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -260,8 +260,8 @@ static int maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
-- 
2.17.1
[PATCH V5] proc: Fix the issue of proc_mem_open returning NULL
Posted by Penglei Jiang 8 months, 2 weeks ago 
The function proc_mem_open() can return an errno, NULL, or mm_struct*.
If it fails to acquire mm, it returns NULL, but the caller does not
check for the case when the return value is NULL.

The following conditions lead to failure in acquiring mm:

  - The task is a kernel thread (PF_KTHREAD)
  - The task is exiting (PF_EXITING)

Changes:

  - Add documentation comments for the return value of proc_mem_open().
  - Add checks in the caller to return -ESRCH when proc_mem_open()
    returns NULL.

Reported-by: syzbot+f9238a0a31f9b5603fef@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000f52642060d4e3750@google.com
Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
---
V4 -> V5: Completed the changelog
V3 -> V4: Revised the comments
V2 -> V3: Added comments to explain the proc_mem_open() return value
V1 -> V2: Added the missing NULL check, dropped the proc_mem_open() modification

 fs/proc/base.c       | 12 +++++++++---
 fs/proc/task_mmu.c   | 12 ++++++------
 fs/proc/task_nommu.c |  4 ++--
 3 files changed, 17 insertions(+), 11 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index b0d4e1908b22..85a3f5e253d4 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -827,7 +827,13 @@ static const struct file_operations proc_single_file_operations = {
 	.release	= single_release,
 };
 
-
+/*
+ * proc_mem_open() can return errno, NULL or mm_struct*.
+ *
+ *   - Returns NULL if the task has no mm (PF_KTHREAD or PF_EXITING)
+ *   - Returns mm_struct* on success
+ *   - Returns error code on failure
+ */
 struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode)
 {
 	struct task_struct *task = get_proc_task(inode);
@@ -854,8 +860,8 @@ static int __mem_open(struct inode *inode, struct file *file, unsigned int mode)
 {
 	struct mm_struct *mm = proc_mem_open(inode, mode);
 
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 
 	file->private_data = mm;
 	return 0;
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 994cde10e3f4..b9e3bd006346 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -212,8 +212,8 @@ static int proc_maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
@@ -1325,8 +1325,8 @@ static int smaps_rollup_open(struct inode *inode, struct file *file)
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		ret = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		ret = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		single_release(inode, file);
 		goto out_free;
@@ -2069,8 +2069,8 @@ static int pagemap_open(struct inode *inode, struct file *file)
 	struct mm_struct *mm;
 
 	mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(mm))
-		return PTR_ERR(mm);
+	if (IS_ERR_OR_NULL(mm))
+		return mm ? PTR_ERR(mm) : -ESRCH;
 	file->private_data = mm;
 	return 0;
 }
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
index bce674533000..59bfd61d653a 100644
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -260,8 +260,8 @@ static int maps_open(struct inode *inode, struct file *file,
 
 	priv->inode = inode;
 	priv->mm = proc_mem_open(inode, PTRACE_MODE_READ);
-	if (IS_ERR(priv->mm)) {
-		int err = PTR_ERR(priv->mm);
+	if (IS_ERR_OR_NULL(priv->mm)) {
+		int err = priv->mm ? PTR_ERR(priv->mm) : -ESRCH;
 
 		seq_release_private(inode, file);
 		return err;
-- 
2.17.1

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.