Thadeu Lima de Souza Cascardo e362359ace posix-cpu-timers: Cleanup CPU timers before freeing them during exec ... Commit 55e8c8eb2c ("posix-cpu-timers: Store a reference to a pid not a task") started looking up tasks by PID when deleting a CPU timer. When a non-leader thread calls execve, it will switch PIDs with the leader process. Then, as it calls exit_itimers, posix_cpu_timer_del cannot find the task because the timer still points out to the old PID. That means that armed timers won't be disarmed, that is, they won't be removed from the timerqueue_list. exit_itimers will still release their memory, and when that list is later processed, it leads to a use-after-free. Clean up the timers from the de-threaded task before freeing them. This prevents a reported use-after-free. Fixes: 55e8c8eb2c ("posix-cpu-timers: Store a reference to a pid not a task") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20220809170751.164716-1-cascardo@canonical.com		2022-08-09 20:02:13 +02:00
..
9p
adfs
affs	affs: use memcpy_to_page and remove replace kmap_atomic()	2022-08-01 19:53:31 +02:00
afs	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
autofs
befs	befs: Convert befs_symlink_read_folio() to use a folio	2022-08-02 12:34:03 -04:00
bfs
btrfs	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
cachefiles	cachefiles: narrow the scope of flushed requests when releasing fd	2022-07-05 16:12:21 +01:00
ceph	netfs: do not unlock and put the folio twice	2022-07-14 10:10:12 +02:00
cifs	smb3: workaround negprot bug in some Samba servers	2022-07-13 19:59:47 -05:00
coda	coda: Convert coda_symlink_filler() to use a folio	2022-08-02 12:34:03 -04:00
configfs
cramfs	cramfs: read_mapping_page() is synchronous	2022-08-02 12:34:02 -04:00
crypto
debugfs
devpts
dlm	fs: dlm: move kref_put assert for lkb structs	2022-08-01 09:31:46 -05:00
ecryptfs
efivarfs	efi: vars: Move efivar caching layer into efivarfs	2022-06-24 20:40:19 +02:00
efs
erofs	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
exfat
exportfs
ext2	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
ext4	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
f2fs	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
fat	attr: port attribute changes to new types	2022-06-26 18:18:56 +02:00
freevxfs	freevxfs: Convert vxfs_immed_read_folio() to use a folio	2022-08-02 12:34:03 -04:00
fscache	fscache: Fix invalidation/lookup race	2022-07-05 16:12:55 +01:00
fuse
gfs2	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
hfs	hfs: Remove check for PageError	2022-06-29 08:51:06 -04:00
hfsplus	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
hostfs	hostfs: Handle page write errors correctly	2022-08-02 12:34:02 -04:00
hpfs
hugetlbfs	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
iomap	New code for 5.20:	2022-08-03 15:16:49 -07:00
isofs	fs/buffer: Combine two submit_bh() and ll_rw_block() arguments	2022-07-14 12:14:32 -06:00
jbd2	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
jffs2
jfs	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
kernfs	kernfs: Fix typo 'the the' in comment	2022-07-28 10:57:25 +02:00
ksmbd	acl: move idmapped mount fixup into vfs_{g,s}etxattr()	2022-07-15 22:08:59 +02:00
lockd	lockd: fix nlm_close_files	2022-07-11 15:49:56 -04:00
minix
netfs	netfs: do not unlock and put the folio twice	2022-07-14 10:10:12 +02:00
nfs	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
nfs_common
nfsd	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
nilfs2	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
nls
notify	fsnotify: Fix comment typo	2022-07-26 13:38:47 +02:00
ntfs	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
ntfs3	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
ocfs2	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
omfs
openpromfs
orangefs	orangefs: Remove test for folio error	2022-06-29 08:51:07 -04:00
overlayfs	Saner handling of "lseek should fail with ESPIPE" - gets rid of	2022-08-03 11:35:20 -07:00
proc	mm: thp: kill __transhuge_page_enabled()	2022-07-17 17:14:33 -07:00
pstore	EFI updates for v5.20	2022-08-03 14:38:02 -07:00
qnx4
qnx6
quota	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
ramfs
reiserfs	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
romfs
smbfs_common
squashfs	squashfs: Return the actual error from squashfs_read_folio()	2022-08-02 12:34:02 -04:00
sysfs
sysv
tracefs	tracefs: Fix syntax errors in comments	2022-06-17 19:01:28 -04:00
ubifs	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
udf	fs/buffer: Combine two submit_bh() and ll_rw_block() arguments	2022-07-14 12:14:32 -06:00
ufs	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
unicode
vboxsf
verity	fs-verity: mention btrfs support	2022-07-15 23:42:30 -07:00
xfs	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
zonefs	zonefs changes for 5.20-rc1	2022-08-03 15:21:53 -07:00
aio.c	iov_iter work, part 1 - isolated cleanups and optimizations.	2022-08-03 13:50:22 -07:00
anon_inodes.c
attr.c	attr: fix kernel doc	2022-06-27 16:08:31 +02:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf_test.c
binfmt_elf.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
buffer.c	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
char_dev.c
compat_binfmt_elf.c
coredump.c	fs: do not compare against ->llseek	2022-07-16 09:19:15 -04:00
d_path.c
dax.c	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
dcache.c	fs/dcache: Move wakeup out of i_seq_dir write held region.	2022-07-30 00:38:16 -04:00
direct-io.c	iov_iter work, part 1 - isolated cleanups and optimizations.	2022-08-03 13:50:22 -07:00
drop_caches.c
eventfd.c
eventpoll.c
exec.c	posix-cpu-timers: Cleanup CPU timers before freeing them during exec	2022-08-09 20:02:13 +02:00
fcntl.c
fhandle.c
file_table.c	iov_iter work, part 1 - isolated cleanups and optimizations.	2022-08-03 13:50:22 -07:00
file.c
filesystems.c
fs_context.c
fs_parser.c
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c
fsopen.c
init.c
inode.c	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
internal.h
ioctl.c
Kconfig
Kconfig.binfmt
kernel_read_file.c
libfs.c
locks.c	fs/lock: Rearrange ops in flock syscall.	2022-07-18 10:01:47 -04:00
Makefile	io_uring: move to separate directory	2022-07-24 18:39:10 -06:00
mbcache.c	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
mount.h	switch try_to_unlazy_next() to __legitimize_mnt()	2022-07-05 16:18:21 -04:00
mpage.c	Folio changes for 6.0	2022-08-03 10:35:43 -07:00
namei.c	step_into(): move fetching ->d_inode past handle_mounts()	2022-07-06 13:16:07 -04:00
namespace.c	switch try_to_unlazy_next() to __legitimize_mnt()	2022-07-05 16:18:21 -04:00
no-block.c
nsfs.c
open.c	iov_iter work, part 1 - isolated cleanups and optimizations.	2022-08-03 13:50:22 -07:00
pipe.c
pnode.c
pnode.h
posix_acl.c	acl: make posix_acl_clone() available to overlayfs	2022-07-15 22:09:57 +02:00
proc_namespace.c
read_write.c	Saner handling of "lseek should fail with ESPIPE" - gets rid of	2022-08-03 11:35:20 -07:00
readdir.c
remap_range.c	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
select.c
seq_file.c
signalfd.c
splice.c	fs: check FMODE_LSEEK to control internal pipe splicing	2022-07-16 09:19:16 -04:00
stack.c
stat.c
statfs.c
super.c	mm: shrinkers: provide shrinkers with names	2022-07-03 18:08:40 -07:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c	- The usual batches of cleanups from Baoquan He, Muchun Song, Miaohe	2022-08-05 16:32:45 -07:00
utimes.c
xattr.c	acl: move idmapped mount fixup into vfs_{g,s}etxattr()	2022-07-15 22:08:59 +02:00