linux-stable/kernel/time
Oleg Nesterov 78a4b8e379 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
commit f90fff1e15 upstream.

If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.

Cc: stable@vger.kernel.org
Reported-by: Benoît Sevens <bsevens@google.com>
Fixes: 0bdd2ed413 ("sched: run_posix_cpu_timers: Don't check ->exit_state, use lock_task_sighand()")
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-06-27 11:02:57 +01:00
..
alarmtimer.c
clockevents.c
clocksource.c
hrtimer.c hrtimers: Mark is_migration_base() with __always_inline 2025-04-10 14:29:36 +02:00
itimer.c
jiffies.c timekeeping: Split jiffies seqlock 2023-05-17 11:35:39 +02:00
Kconfig
Makefile
ntp_internal.h
ntp.c ntp: Safeguard against time_constant overflow 2024-08-19 05:33:52 +02:00
posix-clock.c posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() 2024-11-08 16:20:51 +01:00
posix-cpu-timers.c posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() 2025-06-27 11:02:57 +01:00
posix-stubs.c
posix-timers.c posix-timers: Add cond_resched() to posix_timer_add() search loop 2025-06-04 14:32:31 +02:00
posix-timers.h
sched_clock.c
test_udelay.c
tick-broadcast-hrtimer.c
tick-broadcast.c tick/broadcast: Move per CPU pointer access into the atomic section 2024-08-19 05:33:51 +02:00
tick-common.c tick/nohz_full: Don't abuse smp_call_function_single() in tick_setup_device() 2024-07-05 09:08:19 +02:00
tick-internal.h tick: Get rid of tick_period 2023-05-17 11:35:40 +02:00
tick-oneshot.c
tick-sched.c tick/sched: Preserve number of idle sleeps across CPU hotplug events 2024-02-23 08:24:53 +01:00
tick-sched.h
time.c time: Fix references to _msecs_to_jiffies() handling of values 2024-12-14 19:44:23 +01:00
timeconst.bc
timeconv.c
timecounter.c
timekeeping_debug.c
timekeeping_internal.h
timekeeping.c timekeeping: Fix cross-timestamp interpolation for non-x86 2024-03-26 18:22:14 -04:00
timekeeping.h timekeeping: Split jiffies seqlock 2023-05-17 11:35:39 +02:00
timer_list.c
timer.c timers: Rename del_timer_sync() to timer_delete_sync() 2024-04-13 12:51:21 +02:00
vsyscall.c