From patchwork Fri Mar 1 19:40:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= X-Patchwork-Id: 1906879 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; secure) header.d=lists.infradead.org header.i=@lists.infradead.org header.a=rsa-sha256 header.s=bombadil.20210309 header.b=iBOZnWjn; dkim=pass (1024-bit key; secure) header.d=digikod.net header.i=@digikod.net header.a=rsa-sha256 header.s=20191114 header.b=UNYZ0xJK; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.infradead.org (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org; envelope-from=linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org; receiver=patchwork.ozlabs.org) Received: from bombadil.infradead.org (bombadil.infradead.org [IPv6:2607:7c80:54:3::133]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Tmdk46FQTz1yX7 for ; Sat, 2 Mar 2024 06:41:00 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc: To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=g/YzloGagxw07ZqEzYYosPxBme8ECoh1NNB7drVcOys=; b=iBOZnWjnB2X7uPuT0W90cS6Nb+ /snbmMn0RSKeBLfX+iNfLSaWAux8lgbQ3PHKkHyVEXPYiG7I4KCovysNlvLIM7JLrnIAOMAaLQP6S H2izERum4XlLHoMmcryfTX8ED5Fz9kvngOwotwm/zW3Uzo9A3BOejipm0bRVQ3QOtgp72ug5q6IBm Sx2ibHOzpe5Wc0PlRd3f7Irm4kuxLDOYI+uxbT3XHCRHjNbjlJXCVexbHyMxi2VlgWQ1u/TMCLUlj sKFthZI5LaU6CmCc6fhLBU/3/zu/FB6bc33sz05pLls3V6kT/032PMqInvs1F0zjmNZKys3EDEZlT OeP5T81Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rg8kc-00000001lVp-2e8U; Fri, 01 Mar 2024 19:40:58 +0000 Received: from smtp-42af.mail.infomaniak.ch ([2001:1600:7:10::42af]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rg8kY-00000001lRm-24Vd for linux-um@lists.infradead.org; Fri, 01 Mar 2024 19:40:56 +0000 Received: from smtp-4-0001.mail.infomaniak.ch (smtp-4-0001.mail.infomaniak.ch [10.7.10.108]) by smtp-4-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4Tmdjw0F1Nznjb; Fri, 1 Mar 2024 20:40:52 +0100 (CET) Received: from unknown by smtp-4-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4Tmdjv1xJGznyy; Fri, 1 Mar 2024 20:40:51 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digikod.net; s=20191114; t=1709322051; bh=aBipZnzNTUCokDElM7UYa9F0lGpvUK219Za2n6GQq4Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UNYZ0xJKl83Weh0HZXkX+75DtgbucsYUYb3GwJDzqtVbcYnTvcggNkhy0ioW4MMSZ fnerYo+ZLufmIhR0vKm5k5WdS3vITUXQbsgjc2ISrEzQNh0TIdOvkp4cGNI+MRf3Ur LJCtGilHG9y8nSgLg8D8vSJX5kJXlQ0ztX1gQWyU= From: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= To: Brendan Higgins , David Gow , Kees Cook , Rae Moar , Shuah Khan Cc: =?utf-8?q?Micka=C3=ABl_Sala=C3=BCn?= , Alan Maguire , Borislav Petkov , Dave Hansen , "H . Peter Anvin" , Ingo Molnar , James Morris , Luis Chamberlain , "Madhavan T . Venkataraman" , Marco Pagani , Paolo Bonzini , Sean Christopherson , Stephen Boyd , Thara Gopinath , Thomas Gleixner , Vitaly Kuznetsov , Wanpeng Li , Zahra Tarkhani , kvm@vger.kernel.org, linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-um@lists.infradead.org, x86@kernel.org Subject: [PATCH v2 2/7] kunit: Fix kthread reference Date: Fri, 1 Mar 2024 20:40:32 +0100 Message-ID: <20240301194037.532117-3-mic@digikod.net> In-Reply-To: <20240301194037.532117-1-mic@digikod.net> References: <20240301194037.532117-1-mic@digikod.net> MIME-Version: 1.0 X-Infomaniak-Routing: alpha X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240301_114054_693840_FA953777 X-CRM114-Status: GOOD ( 10.71 ) X-Spam-Score: -0.2 (/) X-Spam-Report: Spam detection software, running on the system "bombadil.infradead.org", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. Cc: Brendan Higgins Cc: David Gow Cc: Rae Moar Cc: Shuah Khan Reviewed-by: Kees Cook List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-um" Errors-To: linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org There is a race condition when a kthread finishes after the deadline and before the call to kthread_stop(), which may lead to use after free. Cc: Brendan Higgins Cc: David Gow Cc: Rae Moar Cc: Shuah Khan Reviewed-by: Kees Cook Signed-off-by: Mickaël Salaün Link: https://lore.kernel.org/r/20240301194037.532117-3-mic@digikod.net Reviewed-by: Rae Moar Reviewed-by: David Gow --- Changes since v1: * Added Kees's Reviewed-by. --- lib/kunit/try-catch.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c index a5cb2ef70a25..73f5007f20ea 100644 --- a/lib/kunit/try-catch.c +++ b/lib/kunit/try-catch.c @@ -11,6 +11,7 @@ #include #include #include +#include #include "try-catch-impl.h" @@ -65,14 +66,15 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) try_catch->context = context; try_catch->try_completion = &try_completion; try_catch->try_result = 0; - task_struct = kthread_run(kunit_generic_run_threadfn_adapter, - try_catch, - "kunit_try_catch_thread"); + task_struct = kthread_create(kunit_generic_run_threadfn_adapter, + try_catch, "kunit_try_catch_thread"); if (IS_ERR(task_struct)) { try_catch->try_result = PTR_ERR(task_struct); try_catch->catch(try_catch->context); return; } + get_task_struct(task_struct); + wake_up_process(task_struct); time_remaining = wait_for_completion_timeout(&try_completion, kunit_test_timeout()); @@ -82,6 +84,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) kthread_stop(task_struct); } + put_task_struct(task_struct); exit_code = try_catch->try_result; if (!exit_code)