diff options
| author | Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com> | 2026-10-12 19:51:49 -0400 |
|---|---|---|
| committer | Thomas Gleixner <tglx@kernel.org> | 2026-10-23 21:35:02 +0200 |
| commit | 8ccd731b63a0183ca2b0e18f3ca15864b3f37eda (patch) | |
| tree | dbed463051022ac938ab9d26c11843e88df58394 /kernel/time | |
| parent | e7cad586d73276cbd4466de81b2092287d7475c0 (diff) | |
posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path
do_cpu_nanosleep() sleeps on a temporary k_itimer whose reference on the
target's struct pid is taken by posix_cpu_timer_create() and dropped by
posix_cpu_timer_del(). When a signal ends the sleep, the timer is
disarmed with posix_cpu_timer_set(), but posix_cpu_timer_del() is only
called for a result of 0 or TIMER_RETRY. If the target thread or process
has exited in the meantime, timer_lock_sighand() finds no task,
posix_cpu_timer_set() returns -ESRCH and the pid reference is leaked.
An unprivileged user can trigger this: sleep on the CPU clock of a
thread, let that thread exit, then signal the sleeper. Each round leaks
one struct pid. Repeating it exhausts unreclaimable slab memory
within minutes:
Out of memory: Killed process 150 (poc) total-vm:789292kB, anon-rss:484kB
Kernel panic - not syncing: System is deadlocked on memory
Fix this by also calling posix_cpu_timer_del() on -ESRCH. With the
target gone, the deletion is safe. It finds no task either and only
drops the pid reference.
Fixes: e26d70d271ee ("posix-timers: Cleanup reaped target handling")
Reported-by: AutonomousCodeSecurity@microsoft.com
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@linux.microsoft.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261012235149.66531-1-cenzhang@linux.microsoft.com
Diffstat (limited to 'kernel/time')
| -rw-r--r-- | kernel/time/posix-cpu-timers.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c index 0bf4fcd969c8..65cc612046d1 100644 --- a/kernel/time/posix-cpu-timers.c +++ b/kernel/time/posix-cpu-timers.c @@ -1600,8 +1600,8 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags, */ expires = cpu_timer_getexpires(&timer.it.cpu); error = posix_cpu_timer_set(&timer, 0, &zero_it, &it); - if (!error) { - /* Timer is now unarmed, deletion can not fail. */ + if (error != TIMER_RETRY) { + /* Unarmed or target gone (-ESRCH), deletion can not fail. */ posix_cpu_timer_del(&timer); } else { while (error == TIMER_RETRY) { |