Re: [tip: timers/urgent] posix-cpu-timers: Prevent UAF caused by non-leader exec() race

[Frederic Weisbecker <frederic@kernel.org>]

Le Wed, Jul 08, 2026 at 08:04:19PM +0200, Thomas Gleixner a écrit :
> On Wed, Jul 08 2026 at 18:43, Oleg Nesterov wrote:
> 
> > On 07/08, Frederic Weisbecker wrote:
> >>
> >> > There is a similar problem vs. posix_cpu_timer_set(). For regular posix
> >> > timers it just transiently returns -ESRCH to user space, but for the use
> >> > case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is
> >> > allocated on the stack.
> >>
> >> do_cpu_nanosleep() only targets current and since it's on the stack, no
> >> other task can access it. And the current task can't be exiting/exec'ing
> >> while calling posix_cpu_timer_set() on that stack timer.
> >
> > I thought the same initially, but it seems that this is not true...
> 
> Indeed.
> 
> > I can never understand this API, but it seems that
> > sys_clock_nanosleep() can target the !current processes/threads ?
> 
> It obviously can't target the current thread because how would that
> accumulate run-time when it's sleeping?
> 
> It can target the current or some other process, so it's subject to the
> non-leader exec race.

Duh! Yes sorry, I got confused with the "timer.it_process = current;"
line which is of course the waiting current task and obviously not the target.

-- 
Frederic Weisbecker
SUSE Labs