Re: [tip: timers/urgent] posix-cpu-timers: Prevent UAF caused by non-leader exec() race

[Thomas Gleixner <tglx@kernel.org>]

On Wed, Jul 08 2026 at 18:43, Oleg Nesterov wrote:

> On 07/08, Frederic Weisbecker wrote:
>>
>> > There is a similar problem vs. posix_cpu_timer_set(). For regular posix
>> > timers it just transiently returns -ESRCH to user space, but for the use
>> > case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is
>> > allocated on the stack.
>>
>> do_cpu_nanosleep() only targets current and since it's on the stack, no
>> other task can access it. And the current task can't be exiting/exec'ing
>> while calling posix_cpu_timer_set() on that stack timer.
>
> I thought the same initially, but it seems that this is not true...

Indeed.

> I can never understand this API, but it seems that
> sys_clock_nanosleep() can target the !current processes/threads ?

It obviously can't target the current thread because how would that
accumulate run-time when it's sleeping?

It can target the current or some other process, so it's subject to the
non-leader exec race.

> Or why else we have clock_getcpuclockid() ?

To express which thread or thread group the sleep should be on. It's
exactly the same as timer_create() + timer_set(). It sleeps until that
clock accumulated enough runtime, while regular posix-timers either wait
for a signal or handle it async.

Thanks,

        tglx