On Sat, 2 Mar 2024 at 03:40, Mickaël Salaün <mic@xxxxxxxxxxx> wrote: > > There is a race condition when a kthread finishes after the deadline and > before the call to kthread_stop(), which may lead to use after free. > > Cc: Brendan Higgins <brendanhiggins@xxxxxxxxxx> > Cc: David Gow <davidgow@xxxxxxxxxx> > Cc: Rae Moar <rmoar@xxxxxxxxxx> > Cc: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx> > Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> > Signed-off-by: Mickaël Salaün <mic@xxxxxxxxxxx> > Link: https://lore.kernel.org/r/20240301194037.532117-3-mic@xxxxxxxxxxx > --- Thanks: I've never been unlucky enough to hit this, but it's definitely a bug. We should ideally mark it with a fixes tag: Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero") Reviewed-by: David Gow <davidgow@xxxxxxxxxx> Cheers, -- David > > Changes since v1: > * Added Kees's Reviewed-by. > --- > lib/kunit/try-catch.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c > index a5cb2ef70a25..73f5007f20ea 100644 > --- a/lib/kunit/try-catch.c > +++ b/lib/kunit/try-catch.c > @@ -11,6 +11,7 @@ > #include <linux/completion.h> > #include <linux/kernel.h> > #include <linux/kthread.h> > +#include <linux/sched/task.h> > > #include "try-catch-impl.h" > > @@ -65,14 +66,15 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) > try_catch->context = context; > try_catch->try_completion = &try_completion; > try_catch->try_result = 0; > - task_struct = kthread_run(kunit_generic_run_threadfn_adapter, > - try_catch, > - "kunit_try_catch_thread"); > + task_struct = kthread_create(kunit_generic_run_threadfn_adapter, > + try_catch, "kunit_try_catch_thread"); > if (IS_ERR(task_struct)) { > try_catch->try_result = PTR_ERR(task_struct); > try_catch->catch(try_catch->context); > return; > } > + get_task_struct(task_struct); > + wake_up_process(task_struct); > > time_remaining = wait_for_completion_timeout(&try_completion, > kunit_test_timeout()); > @@ -82,6 +84,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) > kthread_stop(task_struct); > } > > + put_task_struct(task_struct); > exit_code = try_catch->try_result; > > if (!exit_code) > -- > 2.44.0 >
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
