From: Oleg Nesterov <oleg@redhat.com>
To: Frederic Weisbecker <frederic@kernel.org>
Cc: linux-kernel@vger.kernel.org, linux-tip-commits@vger.kernel.org,
Wongi Lee <qw3rtyp0@gmail.com>, Jungwoo Lee <jwlee2217@gmail.com>,
Thomas Gleixner <tglx@kernel.org>,
stable@vger.kernel.org, x86@kernel.org
Subject: Re: [tip: timers/urgent] posix-cpu-timers: Prevent UAF caused by non-leader exec() race
Date: Wed, 8 Jul 2026 18:43:27 +0200 [thread overview]
Message-ID: <ak5-L-1SzGPEc0_i@redhat.com> (raw)
In-Reply-To: <ak51mpHPzsQrGFmv@localhost.localdomain>
On 07/08, Frederic Weisbecker wrote:
>
> > There is a similar problem vs. posix_cpu_timer_set(). For regular posix
> > timers it just transiently returns -ESRCH to user space, but for the use
> > case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is
> > allocated on the stack.
>
> do_cpu_nanosleep() only targets current and since it's on the stack, no
> other task can access it. And the current task can't be exiting/exec'ing
> while calling posix_cpu_timer_set() on that stack timer.
I thought the same initially, but it seems that this is not true...
I can never understand this API, but it seems that
sys_clock_nanosleep() can target the !current processes/threads ?
Or why else we have clock_getcpuclockid() ?
Oleg.
next prev parent reply other threads:[~2026-07-08 16:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-05 9:46 [tip: timers/urgent] posix-cpu-timers: Prevent UAF caused by non-leader exec() race tip-bot2 for Thomas Gleixner
2026-07-08 16:06 ` Frederic Weisbecker
2026-07-08 16:43 ` Oleg Nesterov [this message]
2026-07-08 18:04 ` Thomas Gleixner
2026-07-08 18:35 ` Oleg Nesterov
2026-07-08 20:27 ` Frederic Weisbecker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ak5-L-1SzGPEc0_i@redhat.com \
--to=oleg@redhat.com \
--cc=frederic@kernel.org \
--cc=jwlee2217@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=qw3rtyp0@gmail.com \
--cc=stable@vger.kernel.org \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.