Re: [PATCH] Fix race between RTDM task termination and xnthread_join

[Richard Weinberger <richard@sigma-star.at>]

On Donnerstag, 29. Jänner 2026 10:57 Jan Kiszka wrote:
> On 29.01.26 09:36, Richard Weinberger wrote:
> > On Donnerstag, 29. Jänner 2026 08:45 'Jan Kiszka' via upstream wrote:
> >> On 27.01.26 22:39, Richard Weinberger wrote:
> >>> Ensure that the task structure remains valid until the join operation is complete.
> >>> Previously, a race condition could cause the structure to be freed before
> >>> xnthread_join() accessed it, leading to a use-after-free scenario.
> >>
> >> Where exactly? xnthread_join performs some checks for the existence of
> >> the target, and it is locking it (find_get_pid).
> > 
> > xnthread_host_pid() in xnthread_join() dereferences the task struct via
> > task_pid_nr().
> 
> Then then next question would be what is protecting the task struct in
> case of userspace task. Is this here only papering over a more
> fundamental issue?

Hmm, for userspace I'd expect that Linux frees the task struct only after
the parent fetched the exit code? So, after zombie state.

Thanks,
//richard

-- 
​​​​​sigma star gmbh | Eduard-Bodem-Gasse 6, 6020 Innsbruck, AUT UID/VAT Nr:
ATU 66964118 | FN: 374287y