Oleg Nesterov f90fff1e15 posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() ... If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. Cc: stable@vger.kernel.org Reported-by: Benoît Sevens <bsevens@google.com> Fixes: 0bdd2ed413 ("sched: run_posix_cpu_timers: Don't check ->exit_state, use lock_task_sighand()") Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2025-06-13 10:55:49 -07:00
..
bpf	- The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox	2025-05-31 15:44:16 -07:00
cgroup	cgroup: A fix for v6.16-rc1	2025-06-03 14:12:36 -07:00
configs	Kbuild updates for v6.16	2025-06-07 10:05:35 -07:00
debug	TTY/Serial driver updates for 6.15-rc1	2025-04-02 18:17:33 -07:00
dma	dma-mapping updates for Linux 6.16:	2025-05-27 20:09:06 -07:00
entry	entry: Inline syscall_exit_to_user_mode()	2025-04-29 08:27:10 +02:00
events	- The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox	2025-05-31 15:44:16 -07:00
futex	- The 2 patch series "zram: support algorithm-specific parameters" from	2025-06-02 16:00:26 -07:00
gcov	kbuild: require gcc-8 and binutils-2.30	2025-04-30 21:53:35 +02:00
irq	Updates for the MSI subsystem (core code and PCI):	2025-05-27 08:15:26 -07:00
kcsan	treewide, timers: Rename destroy_timer_on_stack() as timer_destroy_on_stack()	2025-05-08 19:49:33 +02:00
livepatch	sched,livepatch: Untangle cond_resched() and live-patching	2025-05-14 13:16:24 +02:00
locking	Generic:	2025-06-02 12:24:58 -07:00
module	Kbuild updates for v6.16	2025-06-07 10:05:35 -07:00
power	- The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox	2025-05-31 15:44:16 -07:00
printk	printk changes for 6.15	2025-03-27 19:22:24 -07:00
rcu	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
sched	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
time	posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()	2025-06-13 10:55:49 -07:00
trace	tracing: Do not free "head" on error path of filter_free_subsystem_filters()	2025-06-10 09:39:58 -04:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.kexec	- The 3 patch series "hung_task: extend blocking task stacktrace dump to	2025-05-31 19:12:53 -07:00
Kconfig.locks	…
Kconfig.preempt	…
Makefile	- The 3 patch series "hung_task: extend blocking task stacktrace dump to	2025-05-31 19:12:53 -07:00
acct.c	…
async.c	…
audit.c	audit: record AUDIT_ANOM_* events regardless of presence of rules	2025-04-11 14:14:41 -04:00
audit.h	…
audit_fsnotify.c	…
audit_tree.c	…
audit_watch.c	fs: add kern_path_locked_negative()	2025-04-15 11:32:34 +02:00
auditfilter.c	…
auditsc.c	…
backtracetest.c	…
bounds.c	…
capability.c	…
cfi.c	Modules changes for 6.15-rc1	2025-03-30 15:44:36 -07:00
compat.c	…
configs.c	…
context_tracking.c	…
cpu.c	perf: Remove too early and redundant CPU hotplug handling	2025-05-08 21:50:19 +02:00
cpu_pm.c	…
crash_core.c	…
crash_dump_dm_crypt.c	crash_dump: retrieve dm crypt keys in kdump kernel	2025-05-21 10:48:21 -07:00
crash_reserve.c	crash: fix spelling mistake "crahskernel" -> "crashkernel"	2025-05-11 17:54:10 -07:00
cred.c	…
delayacct.c	delayacct: remove redundant code and adjust indentation	2025-05-27 19:40:33 -07:00
dma.c	…
elfcorehdr.c	…
exec_domain.c	…
exit.c	- The 3 patch series "hung_task: extend blocking task stacktrace dump to	2025-05-31 19:12:53 -07:00
exit.h	…
extable.c	…
fail_function.c	…
fork.c	- The 11 patch series "Add folio_mk_pte()" from Matthew Wilcox	2025-05-31 15:44:16 -07:00
freezer.c	…
gen_kheaders.sh	…
groups.c	…
hung_task.c	hung_task: show the blocker task if the task is hung on semaphore	2025-05-11 17:54:08 -07:00
iomem.c	…
irq_work.c	…
jump_label.c	…
kallsyms.c	…
kallsyms_internal.h	…
kallsyms_selftest.c	…
kallsyms_selftest.h	…
kcmp.c	…
kcov.c	…
kexec.c	…
kexec_core.c	kexec: define functions to map and unmap segments	2025-04-29 15:54:53 -04:00
kexec_elf.c	…
kexec_file.c	- The 3 patch series "hung_task: extend blocking task stacktrace dump to	2025-05-31 19:12:53 -07:00
kexec_handover.c	kexec: add KHO support to kexec file loads	2025-05-12 23:50:40 -07:00
kexec_internal.h	kexec: add KHO support to kexec file loads	2025-05-12 23:50:40 -07:00
kheaders.c	…
kprobes.c	…
ksyms_common.c	…
ksysfs.c	…
kthread.c	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
latencytop.c	…
module_signature.c	…
notifier.c	…
nsproxy.c	kernel/nsproxy: remove unnecessary guards	2025-05-09 13:13:54 +02:00
padata.c	padata: do not leak refcount in reorder_work	2025-05-19 13:44:16 +08:00
panic.c	- The 3 patch series "hung_task: extend blocking task stacktrace dump to	2025-05-31 19:12:53 -07:00
params.c	module: ensure that kobject_put() is safe for module type kobjects	2025-05-07 20:24:59 +02:00
pid.c	pidfs: detect refcount bugs	2025-05-06 13:59:00 +02:00
pid_namespace.c	…
pid_sysctl.h	…
profile.c	…
ptrace.c	ptrace: introduce PTRACE_SET_SYSCALL_INFO request	2025-05-11 17:48:15 -07:00
range.c	…
reboot.c	- The 7 patch series "powerpc/crash: use generic crashkernel	2025-04-01 10:06:52 -07:00
regset.c	…
relay.c	relay: remove unused relay_late_setup_files	2025-05-11 17:54:09 -07:00
resource.c	…
resource_kunit.c	…
rseq.c	…
scftorture.c	…
scs.c	…
seccomp.c	…
signal.c	signal: Move signal ctl tables into signal.c	2025-04-09 13:32:16 +02:00
smp.c	…
smpboot.c	…
smpboot.h	…
softirq.c	lockdep: Fix wait context check on softirq for PREEMPT_RT	2025-03-25 10:46:44 +01:00
stackleak.c	…
stacktrace.c	…
static_call.c	…
static_call_inline.c	Modules changes for 6.15-rc1	2025-03-30 15:44:36 -07:00
stop_machine.c	…
sys.c	futex: Add basic infrastructure for local task local hash	2025-05-03 12:02:07 +02:00
sys_ni.c	…
sysctl-test.c	sysctl: move u8 register test to lib/test_sysctl.c	2025-04-14 14:13:41 +02:00
sysctl.c	sparc: mv sparc sysctls into their own file under arch/sparc/kernel	2025-04-09 13:32:16 +02:00
task_work.c	…
taskstats.c	…
torture.c	…
tracepoint.c	…
tsacct.c	…
ucount.c	…
uid16.c	…
uid16.h	…
umh.c	…
up.c	…
user-return-notifier.c	…
user.c	…
user_namespace.c	…
usermode_driver.c	…
utsname.c	…
utsname_sysctl.c	…
vhost_task.c	vhost_task: fix vhost_task_create() documentation	2025-04-18 10:08:11 -04:00
vmcore_info.c	crash: export PAGE_UNACCEPTED_MAPCOUNT_VALUE to vmcoreinfo	2025-05-11 17:54:04 -07:00
watch_queue.c	…
watchdog.c	kernel/watchdog: add /sys/kernel/{hard,soft}lockup_count	2025-05-21 10:48:22 -07:00
watchdog_buddy.c	…
watchdog_perf.c	- The 7 patch series "powerpc/crash: use generic crashkernel	2025-04-01 10:06:52 -07:00
workqueue.c	treewide, timers: Rename from_timer() to timer_container_of()	2025-06-08 09:07:37 +02:00
workqueue_internal.h	…