shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 02:50:49 +09:00
Code Issues Packages Projects Releases Wiki Activity

kunit: Fix kthread reference

Browse Source 
[ Upstream commit f8aa1b98ce40184521ed95ec26cc115a255183b2 ]

There is a race condition when a kthread finishes after the deadline and
before the call to kthread_stop(), which may lead to use after free.

Cc: Brendan Higgins <brendanhiggins@google.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Fixes: adf5054570 ("kunit: fix UAF when run kfence test case test_gfpzero")
Reviewed-by: David Gow <davidgow@google.com>
Reviewed-by: Rae Moar <rmoar@google.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Mickaël Salaün
2024-04-08 09:46:20 +02:00
committed by Greg Kroah-Hartman
parent b48efc18de
commit 1f2ebd3758
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
lib/kunit/try-catch.c
View File

@@ -11,6 +11,7 @@
#include <linux/completion.h> #include <linux/completion.h>
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/kthread.h> #include <linux/kthread.h>
#include <linux/sched/task.h>
#include "try-catch-impl.h" #include "try-catch-impl.h"
@@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
try_catch->context = context; try_catch->context = context;
try_catch->try_completion = &try_completion; try_catch->try_completion = &try_completion;
try_catch->try_result = 0; try_catch->try_result = 0;
task_struct = kthread_run(kunit_generic_run_threadfn_adapter, task_struct = kthread_create(kunit_generic_run_threadfn_adapter,
try_catch, try_catch, "kunit_try_catch_thread");
"kunit_try_catch_thread");
if (IS_ERR(task_struct)) { if (IS_ERR(task_struct)) {
try_catch->catch(try_catch->context); try_catch->catch(try_catch->context);
return; return;
} }
get_task_struct(task_struct);
wake_up_process(task_struct);
time_remaining = wait_for_completion_timeout(&try_completion, time_remaining = wait_for_completion_timeout(&try_completion,
kunit_test_timeout()); kunit_test_timeout());
@@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
kthread_stop(task_struct); kthread_stop(task_struct);
} }
put_task_struct(task_struct);
exit_code = try_catch->try_result; exit_code = try_catch->try_result;
if (!exit_code) if (!exit_code)