From: Greg Kroah-Hartman Date: Tue, 21 Jul 2026 14:16:50 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4e33bb6bc81a3d8aac7f4e82f3e45ce85f8b1df6;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: posix-cpu-timers-prevent-uaf-caused-by-non-leader-exec-race.patch posix-timers-expand-timer_arm-callbacks-with-a-boolean-return-value.patch --- diff --git a/queue-7.1/posix-cpu-timers-prevent-uaf-caused-by-non-leader-exec-race.patch b/queue-7.1/posix-cpu-timers-prevent-uaf-caused-by-non-leader-exec-race.patch new file mode 100644 index 0000000000..bb2e9d7c44 --- /dev/null +++ b/queue-7.1/posix-cpu-timers-prevent-uaf-caused-by-non-leader-exec-race.patch @@ -0,0 +1,409 @@ +From 798a9d582522eb528daf68b629de8707482e563b Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Fri, 3 Jul 2026 12:02:38 +0200 +Subject: posix-cpu-timers: Prevent UAF caused by non-leader exec() race + +From: Thomas Gleixner + +commit 920f893f735e92ba3a1cd9256899a186b161928d upstream. + +Wongi and Jungwoo decoded and reported a non-leader exec() related race +which can result in an UAF: + + sys_timer_delete() exec() + posix_cpu_timer_del() + // Observes old leader + p = pid_task(pid, pid_type); de_thread() + switch_leader(); + release_task(old_leader) + __exit_signal(old_leader) + sighand = lock(old_leader, sighand); + posix_cpu_timers*_exit(); + sighand = lock_task_sighand(p) unhash_task(old_leader); + sh = lock(p, sighand) old_leader->sighand = NULL; + unlock(sighand); + (p->sighand == NULL) + unlock(sh) + return NULL; + + // Returns without action + if(!sighand) + return 0; + free_posix_timer(); + +This is "harmless" unless the deleted timer was armed and enqueued in +p->signal because on exec() a TGID targeted timer is inherited. + +As sys_timer_delete() freed the underlying posix timer object +run_posix_cpu_timers() or any timerqueue related add/delete operations on +other timers will access the freed object's timerqueue node, which results +in an UAF. + +There is a similar problem vs. posix_cpu_timer_set(). For regular posix +timers it just transiently returns -ESRCH to user space, but for the use +case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is +allocated on the stack. + +Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops +to expire. + +While debating solutions Frederic pointed out another problem: + + posix_cpu_timer_del(tmr) + __exit_signal(p) + posix_cpu_timers*_exit(p); + unhash_task(p); + p->sighand = NULL; + sh = lock_task_sighand(p) + sighand = p->sighand; + if (!sighand) + return NULL; + lock(sighand); + + if (!sh) + WARN_ON_ONCE(timer_queued(tmr)); + +On weakly ordered architectures it is not guaranteed that +posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() +when p->sighand is observed as NULL, which means the WARN() can be a false +positive. + +Solve these issues by: + + 1) Changing the store in __exit_signal() to smp_store_release(). + + 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path + of lock_task_sighand(). + + 3) Creating a helper function for looking up the task and locking sighand + which does not return when sighand == NULL. Instead it retries the + task lookup and only if that fails it gives up. + + 4) Using that helper in the three affected functions. + +observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() +and the ones in unhash_task(). + +gracefully. When the task lookup returns the old leader, but sighand == +NULL then it retries. In the non-leader exec() case the subsequent task +lookup will observe the new leader due to #1/#2. In normal exit() scenarios +the subsequent lookup fails. + +When the task lookup fails, the function also checks whether the timer is +still enqueued and issues a warning if that's the case. Unfortunately there +is nothing which can be done about it, but as the task is already not +longer visible the timer should not be accessed anymore. This check also +requires memory ordering, which is not provided when the first lookup +fails. To achieve that the check is preceeded by a smp_rmb() which pairs +with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that +the stores in posix_cpu_timers*_exit() are visible. + +The history of the non-leader exec() issue goes back to the early days of +posix CPU timers, which stored a pointer to the group leader task in the +timer. That obviously fails when a non-leader exec() switches the leader. +commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems +with mt exec") added a temporary workaround for that in 2010 which survived +about 10 years. The fix for the workaround changed the task pointer to a +pid pointer, but failed to see the subtle race described above. So the +Fixes tag picks that commit, which seems to be halfways accurate. + +Thanks to Frederic Weissbecker, Oleg Nesterov and Peter Zijlstra for +review, feedback and suggestions and to Wongi and Jungwoo for the excellent +bug report and analysis! + +Fixes: 55e8c8eb2c7b ("posix-cpu-timers: Store a reference to a pid not a task") +Reported-by: Wongi Lee +Reported-by: Jungwoo Lee +Signed-off-by: Thomas Gleixner +Reviewed-by: Oleg Nesterov +Cc: stable@vger.kernel.org +Signed-off-by: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + kernel/exit.c | 7 + + kernel/signal.c | 10 ++ + kernel/time/posix-cpu-timers.c | 173 +++++++++++++++++++++++++++-------------- + 3 files changed, 130 insertions(+), 60 deletions(-) + +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -212,7 +212,12 @@ static void __exit_signal(struct release + __unhash_process(post, tsk, group_dead); + write_sequnlock(&sig->stats_lock); + +- tsk->sighand = NULL; ++ /* ++ * Ensure that all preceeding state is visible. Pairs with ++ * the smp_acquire__after_ctrl_dep() in the sighand == NULL ++ * path of lock_task_sighand(). ++ */ ++ smp_store_release(&tsk->sighand, NULL); + spin_unlock(&sighand->siglock); + + __cleanup_sighand(sighand); +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -1362,8 +1362,16 @@ struct sighand_struct *lock_task_sighand + rcu_read_lock(); + for (;;) { + sighand = rcu_dereference(tsk->sighand); +- if (unlikely(sighand == NULL)) ++ if (unlikely(sighand == NULL)) { ++ /* ++ * Pairs with the smp_store_release() in ++ * __exit_signal(). It ensures that all state ++ * modifications to the task preceeding the store are ++ * visible to the callers of lock_task_sighand(). ++ */ ++ smp_acquire__after_ctrl_dep(); + break; ++ } + + /* + * This sighand can be already freed and even reused, but +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -461,6 +461,109 @@ static void disarm_timer(struct k_itimer + trigger_base_recalc_expires(timer, p); + } + ++/* ++ * Lookup the task via timer->it.cpu.pid and attempt to lock the task's sighand. ++ * ++ * This can race with the reaping of the task: ++ * ++ * CPU0 CPU1 ++ * ++ * // Finds task ++ * p = pid_task(pid, pid_type); __exit_signal(p) ++ * lock(p, sighand); ++ * posix_cpu_timers*_exit(); ++ * sighand = lock_task_sighand(p); unhash_task(p); ++ * p->sighand = NULL; ++ * unlock(sighand); ++ * ++ * In this case sighand is NULL, which means the task and the associated timer ++ * queue cannot be longer accessed safely. ++ * ++ * __exit_signal() invokes posix_cpu_timers_exit() and if the thread group is ++ * dead it also invokes posix_cpu_timers_group_exit(). These functions delete ++ * all pending timers from the related timer queues. The POSIX timers (k_itimer) ++ * themself are still accessible, but not longer connected to the task. ++ * ++ * exec() works slightly differently. The task which exec()'s terminates all ++ * other threads in the thread group and runs __exit_signal() on them. As the ++ * thread group is not dead they only clean up the per task timers via ++ * posix_cpu_timers_exit(). ++ * ++ * As the TGID on exec() stays the same per process timers stay queued, if they ++ * are armed. This works without a problem when exec() is done by the thread ++ * group leader. If a non-leader thread exec()'s this can end up in the ++ * following scenario: ++ * ++ * CPU0 CPU1 ++ * // Returns old leader ++ * p = pid_task(pid, pid_type); de_thread() ++ * switch_leader() ++ * release_task(old leader) ++ * __exit_signal() ++ * old_leader->sighand = NULL; ++ * // Returns NULL ++ * sighand = lock_task_sighand(p) ++ * ++ * That's problematic for several functions: ++ * ++ * - posix_cpu_timer_del(): If the timer is still enqueued on the task the ++ * underlying k_itimer will be freed which results in a UAF in ++ * run_posix_cpu_timers() or on timerqueue related add/delete operations. ++ * If the timer is not enqueued, the failure is harmless ++ * ++ * - posix_cpu_timer_set(): Independent of the enqueued state that results in a ++ * transient failure which is user space visible (-ESRCH) for regular posix ++ * timers. But for the use case in do_cpu_nanosleep() it's the same UAF ++ * problem just that the timer is allocated on the stack. ++ * ++ * - posix_cpu_timer_rearm(): Timer is not enqueued at that point, but this ++ * silently ignores the rearm request, which is a functional problem as the ++ * timer wont expire anymore. ++ */ ++static struct task_struct *timer_lock_sighand(struct k_itimer *timer, unsigned long *flags) ++{ ++ enum pid_type type = clock_pid_type(timer->it_clock); ++ struct cpu_timer *ctmr = &timer->it.cpu; ++ ++ guard(rcu)(); ++ ++ for (;;) { ++ struct task_struct *t = pid_task(timer->it.cpu.pid, type); ++ ++ /* Fail if the task cannot be found. */ ++ if (!t) ++ break; ++ ++ /* Try to lock the task's sighand */ ++ if (lock_task_sighand(t, flags)) ++ return t; ++ ++ /* ++ * The next PID lookup might either fail or return the new ++ * leader. This is correct for both exit() and exec(). ++ */ ++ } ++ ++ /* ++ * If the timer is still enqueued, warn. There is nothing safe to do ++ * here as there might be two timers in there which are removed in ++ * parallel and that will cause more damage than good. This should never ++ * happen! ++ * ++ * Ensure that the stores to the timer and timerqueue are visible: ++ * ++ * __exit_signal() ++ * posix_cpu_timers*_exit() ++ * write_seqlock(seqlock) ++ * smp_wmb(); <------- ++ * __unhash_process() | !pid_task() ++ * ----> smp_rmb(); ++ * WARN_ON_ONCE(...) ++ */ ++ smp_rmb(); ++ WARN_ON_ONCE(ctmr->head || timerqueue_node_queued(&ctmr->node)); ++ return NULL; ++} + + /* + * Clean up a CPU-clock timer that is about to be destroyed. +@@ -470,29 +573,13 @@ static void disarm_timer(struct k_itimer + */ + static int posix_cpu_timer_del(struct k_itimer *timer) + { +- struct cpu_timer *ctmr = &timer->it.cpu; +- struct sighand_struct *sighand; + struct task_struct *p; + unsigned long flags; + int ret = 0; + +- rcu_read_lock(); +- p = cpu_timer_task_rcu(timer); +- if (!p) +- goto out; ++ p = timer_lock_sighand(timer, &flags); + +- /* +- * Protect against sighand release/switch in exit/exec and process/ +- * thread timer list entry concurrent read/writes. +- */ +- sighand = lock_task_sighand(p, &flags); +- if (unlikely(sighand == NULL)) { +- /* +- * This raced with the reaping of the task. The exit cleanup +- * should have removed this timer from the timer queue. +- */ +- WARN_ON_ONCE(ctmr->head || timerqueue_node_queued(&ctmr->node)); +- } else { ++ if (likely(p)) { + if (timer->it.cpu.firing) { + /* + * Prevent signal delivery. The timer cannot be dequeued +@@ -508,11 +595,8 @@ static int posix_cpu_timer_del(struct k_ + unlock_task_sighand(p, &flags); + } + +-out: +- rcu_read_unlock(); +- + if (!ret) { +- put_pid(ctmr->pid); ++ put_pid(timer->it.cpu.pid); + timer->it_status = POSIX_TIMER_DISARMED; + } + return ret; +@@ -626,21 +710,17 @@ static int posix_cpu_timer_set(struct k_ + clockid_t clkid = CPUCLOCK_WHICH(timer->it_clock); + struct cpu_timer *ctmr = &timer->it.cpu; + u64 old_expires, new_expires, now; +- struct sighand_struct *sighand; + struct task_struct *p; + unsigned long flags; + int ret = 0; + +- rcu_read_lock(); +- p = cpu_timer_task_rcu(timer); +- if (!p) { +- /* +- * If p has just been reaped, we can no +- * longer get any information about it at all. +- */ +- rcu_read_unlock(); ++ p = timer_lock_sighand(timer, &flags); ++ /* ++ * If p has just been reaped, we can no longer get any information about ++ * it at all. ++ */ ++ if (!p) + return -ESRCH; +- } + + /* + * Use the to_ktime conversion because that clamps the maximum +@@ -648,20 +728,6 @@ static int posix_cpu_timer_set(struct k_ + */ + new_expires = ktime_to_ns(timespec64_to_ktime(new->it_value)); + +- /* +- * Protect against sighand release/switch in exit/exec and p->cpu_timers +- * and p->signal->cpu_timers read/write in arm_timer() +- */ +- sighand = lock_task_sighand(p, &flags); +- /* +- * If p has just been reaped, we can no +- * longer get any information about it at all. +- */ +- if (unlikely(sighand == NULL)) { +- rcu_read_unlock(); +- return -ESRCH; +- } +- + /* Retrieve the current expiry time before disarming the timer */ + old_expires = cpu_timer_getexpires(ctmr); + +@@ -698,7 +764,7 @@ static int posix_cpu_timer_set(struct k_ + /* Retry if the timer expiry is running concurrently */ + if (unlikely(ret)) { + unlock_task_sighand(p, &flags); +- goto out; ++ return ret; + } + + /* Convert relative expiry time to absolute */ +@@ -733,8 +799,6 @@ static int posix_cpu_timer_set(struct k_ + */ + if (!sigev_none && new_expires && now >= new_expires) + cpu_timer_fire(timer); +-out: +- rcu_read_unlock(); + return ret; + } + +@@ -1018,19 +1082,12 @@ static void check_process_timers(struct + static bool posix_cpu_timer_rearm(struct k_itimer *timer) + { + clockid_t clkid = CPUCLOCK_WHICH(timer->it_clock); +- struct sighand_struct *sighand; + struct task_struct *p; + unsigned long flags; + u64 now; + +- guard(rcu)(); +- p = cpu_timer_task_rcu(timer); +- if (!p) +- return true; +- +- /* Protect timer list r/w in arm_timer() */ +- sighand = lock_task_sighand(p, &flags); +- if (unlikely(sighand == NULL)) ++ p = timer_lock_sighand(timer, &flags); ++ if (unlikely(!p)) + return true; + + /* diff --git a/queue-7.1/posix-timers-expand-timer_arm-callbacks-with-a-boolean-return-value.patch b/queue-7.1/posix-timers-expand-timer_arm-callbacks-with-a-boolean-return-value.patch new file mode 100644 index 0000000000..cf2af1d311 --- /dev/null +++ b/queue-7.1/posix-timers-expand-timer_arm-callbacks-with-a-boolean-return-value.patch @@ -0,0 +1,170 @@ +From 484d452c7a831d9d37dfa7589d203e05a835e369 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 8 Apr 2026 13:53:56 +0200 +Subject: posix-timers: Expand timer_[re]arm() callbacks with a boolean return value + +From: Thomas Gleixner + +commit 6fdb2677a594ab38eade927919bbd4d9688bfa1c upstream. + +In order to catch expiry times which are already in the past the +timer_arm() and timer_rearm() callbacks need to be able to report back to +the caller whether the timer has been queued or not. + +Change the function signature and let all implementations return true for +now. While at it simplify posix_cpu_timer_rearm(). + +No functional change intended. + +Signed-off-by: Thomas Gleixner +Reviewed-by: Frederic Weisbecker +Acked-by: Peter Zijlstra (Intel) +Acked-by: John Stultz +Link: https://patch.msgid.link/20260408114952.130222296@kernel.org +Signed-off-by: Salvatore Bonaccorso +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/alarmtimer.c | 6 ++++-- + kernel/time/posix-cpu-timers.c | 18 ++++++++++-------- + kernel/time/posix-timers.c | 6 ++++-- + kernel/time/posix-timers.h | 4 ++-- + 4 files changed, 20 insertions(+), 14 deletions(-) + +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -525,12 +525,13 @@ static void alarm_handle_timer(struct al + * alarm_timer_rearm - Posix timer callback for rearming timer + * @timr: Pointer to the posixtimer data struct + */ +-static void alarm_timer_rearm(struct k_itimer *timr) ++static bool alarm_timer_rearm(struct k_itimer *timr) + { + struct alarm *alarm = &timr->it.alarm.alarmtimer; + + timr->it_overrun += alarm_forward_now(alarm, timr->it_interval); + alarm_start(alarm, alarm->node.expires); ++ return true; + } + + /** +@@ -586,7 +587,7 @@ static void alarm_timer_wait_running(str + * @absolute: Expiry value is absolute time + * @sigev_none: Posix timer does not deliver signals + */ +-static void alarm_timer_arm(struct k_itimer *timr, ktime_t expires, ++static bool alarm_timer_arm(struct k_itimer *timr, ktime_t expires, + bool absolute, bool sigev_none) + { + struct alarm *alarm = &timr->it.alarm.alarmtimer; +@@ -598,6 +599,7 @@ static void alarm_timer_arm(struct k_iti + alarm->node.expires = expires; + else + alarm_start(&timr->it.alarm.alarmtimer, expires); ++ return true; + } + + /** +--- a/kernel/time/posix-cpu-timers.c ++++ b/kernel/time/posix-cpu-timers.c +@@ -19,7 +19,7 @@ + + #include "posix-timers.h" + +-static void posix_cpu_timer_rearm(struct k_itimer *timer); ++static bool posix_cpu_timer_rearm(struct k_itimer *timer); + + void posix_cputimers_group_init(struct posix_cputimers *pct, u64 cpu_limit) + { +@@ -1011,24 +1011,27 @@ static void check_process_timers(struct + /* + * This is called from the signal code (via posixtimer_rearm) + * when the last timer signal was delivered and we have to reload the timer. ++ * ++ * Return true unconditionally so the core code assumes the timer to be ++ * armed. Otherwise it would requeue the signal. + */ +-static void posix_cpu_timer_rearm(struct k_itimer *timer) ++static bool posix_cpu_timer_rearm(struct k_itimer *timer) + { + clockid_t clkid = CPUCLOCK_WHICH(timer->it_clock); +- struct task_struct *p; + struct sighand_struct *sighand; ++ struct task_struct *p; + unsigned long flags; + u64 now; + +- rcu_read_lock(); ++ guard(rcu)(); + p = cpu_timer_task_rcu(timer); + if (!p) +- goto out; ++ return true; + + /* Protect timer list r/w in arm_timer() */ + sighand = lock_task_sighand(p, &flags); + if (unlikely(sighand == NULL)) +- goto out; ++ return true; + + /* + * Fetch the current sample and update the timer's expiry time. +@@ -1045,8 +1048,7 @@ static void posix_cpu_timer_rearm(struct + */ + arm_timer(timer, p); + unlock_task_sighand(p, &flags); +-out: +- rcu_read_unlock(); ++ return true; + } + + /** +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -288,12 +288,13 @@ static inline int timer_overrun_to_int(s + return (int)timr->it_overrun_last; + } + +-static void common_hrtimer_rearm(struct k_itimer *timr) ++static bool common_hrtimer_rearm(struct k_itimer *timr) + { + struct hrtimer *timer = &timr->it.real.timer; + + timr->it_overrun += hrtimer_forward_now(timer, timr->it_interval); + hrtimer_restart(timer); ++ return true; + } + + static bool __posixtimer_deliver_signal(struct kernel_siginfo *info, struct k_itimer *timr) +@@ -795,7 +796,7 @@ SYSCALL_DEFINE1(timer_getoverrun, timer_ + return timer_overrun_to_int(scoped_timer); + } + +-static void common_hrtimer_arm(struct k_itimer *timr, ktime_t expires, ++static bool common_hrtimer_arm(struct k_itimer *timr, ktime_t expires, + bool absolute, bool sigev_none) + { + struct hrtimer *timer = &timr->it.real.timer; +@@ -822,6 +823,7 @@ static void common_hrtimer_arm(struct k_ + + if (!sigev_none) + hrtimer_start_expires(timer, HRTIMER_MODE_ABS); ++ return true; + } + + static int common_hrtimer_try_to_cancel(struct k_itimer *timr) +--- a/kernel/time/posix-timers.h ++++ b/kernel/time/posix-timers.h +@@ -27,11 +27,11 @@ struct k_clock { + int (*timer_del)(struct k_itimer *timr); + void (*timer_get)(struct k_itimer *timr, + struct itimerspec64 *cur_setting); +- void (*timer_rearm)(struct k_itimer *timr); ++ bool (*timer_rearm)(struct k_itimer *timr); + s64 (*timer_forward)(struct k_itimer *timr, ktime_t now); + ktime_t (*timer_remaining)(struct k_itimer *timr, ktime_t now); + int (*timer_try_to_cancel)(struct k_itimer *timr); +- void (*timer_arm)(struct k_itimer *timr, ktime_t expires, ++ bool (*timer_arm)(struct k_itimer *timr, ktime_t expires, + bool absolute, bool sigev_none); + void (*timer_wait_running)(struct k_itimer *timr); + }; diff --git a/queue-7.1/series b/queue-7.1/series index a3b3cc50ec..711414e0c8 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -2073,3 +2073,5 @@ exfat-add-data_start_bytes-and-exfat_cluster_to_phys_bytes-helper.patch exfat-fix-implicit-declaration-of-brelse.patch iomap-consolidate-bio-submission.patch drm-amd-display-fix-color-manager-3dlut-shaper-blend.patch +posix-timers-expand-timer_arm-callbacks-with-a-boolean-return-value.patch +posix-cpu-timers-prevent-uaf-caused-by-non-leader-exec-race.patch