Patch "kunit: Fix kthread reference" has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    kunit: Fix kthread reference

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     kunit-fix-kthread-reference.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 508518de9b4e8972b6fe8c852483cd69e3d7135b
Author: Mickaël Salaün <mic@xxxxxxxxxxx>
Date:   Mon Apr 8 09:46:20 2024 +0200

    kunit: Fix kthread reference
    
    [ Upstream commit f8aa1b98ce40184521ed95ec26cc115a255183b2 ]
    
    There is a race condition when a kthread finishes after the deadline and
    before the call to kthread_stop(), which may lead to use after free.
    
    Cc: Brendan Higgins <brendanhiggins@xxxxxxxxxx>
    Cc: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero")
    Reviewed-by: David Gow <davidgow@xxxxxxxxxx>
    Reviewed-by: Rae Moar <rmoar@xxxxxxxxxx>
    Signed-off-by: Mickaël Salaün <mic@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@xxxxxxxxxxx
    Signed-off-by: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
index f7825991d576a..d9d1df28cc52e 100644
--- a/lib/kunit/try-catch.c
+++ b/lib/kunit/try-catch.c
@@ -11,6 +11,7 @@
 #include <linux/completion.h>
 #include <linux/kernel.h>
 #include <linux/kthread.h>
+#include <linux/sched/task.h>
 
 #include "try-catch-impl.h"
 
@@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
 	try_catch->context = context;
 	try_catch->try_completion = &try_completion;
 	try_catch->try_result = 0;
-	task_struct = kthread_run(kunit_generic_run_threadfn_adapter,
-				  try_catch,
-				  "kunit_try_catch_thread");
+	task_struct = kthread_create(kunit_generic_run_threadfn_adapter,
+				     try_catch, "kunit_try_catch_thread");
 	if (IS_ERR(task_struct)) {
 		try_catch->catch(try_catch->context);
 		return;
 	}
+	get_task_struct(task_struct);
+	wake_up_process(task_struct);
 
 	time_remaining = wait_for_completion_timeout(&try_completion,
 						     kunit_test_timeout());
@@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
 		kthread_stop(task_struct);
 	}
 
+	put_task_struct(task_struct);
 	exit_code = try_catch->try_result;
 
 	if (!exit_code)