Michael Pratt d5d21724af posix-cpu-timers: Clear task::posix_cputimers_work in copy_process() ... commit ca7752caea upstream. copy_process currently copies task_struct.posix_cputimers_work as-is. If a timer interrupt arrives while handling clone and before dup_task_struct completes then the child task will have: 1. posix_cputimers_work.scheduled = true 2. posix_cputimers_work.work queued. copy_process clears task_struct.task_works, so (2) will have no effect and posix_cpu_timers_work will never run (not to mention it doesn't make sense for two tasks to share a common linked list). Since posix_cpu_timers_work never runs, posix_cputimers_work.scheduled is never cleared. Since scheduled is set, future timer interrupts will skip scheduling work, with the ultimate result that the task will never receive timer expirations. Together, the complete flow is: 1. Task 1 calls clone(), enters kernel. 2. Timer interrupt fires, schedules task work on Task 1. 2a. task_struct.posix_cputimers_work.scheduled = true 2b. task_struct.posix_cputimers_work.work added to task_struct.task_works. 3. dup_task_struct() copies Task 1 to Task 2. 4. copy_process() clears task_struct.task_works for Task 2. 5. Future timer interrupts on Task 2 see task_struct.posix_cputimers_work.scheduled = true and skip scheduling work. Fix this by explicitly clearing contents of task_struct.posix_cputimers_work in copy_process(). This was never meant to be shared or inherited across tasks in the first place. Fixes: 1fb497dd00 ("posix-cpu-timers: Provide mechanisms to defer timer handling to task_work") Reported-by: Rhys Hiltner <rhys@justin.tv> Signed-off-by: Michael Pratt <mpratt@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20211101210615.716522-1-mpratt@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-11-18 19:17:14 +01:00
..
bpf	bpf: Fix propagation of signed bounds from 64-bit min/max into 32-bit.	2021-11-18 19:16:45 +01:00
cgroup	cgroup: Fix rootcg cpu.stat guest double counting	2021-11-18 19:16:45 +01:00
configs	drivers/char: remove /dev/kmem for good	2021-05-07 00:26:34 -07:00
debug	kdb: Adopt scheduler's task classification	2021-11-18 19:17:06 +01:00
dma	dma-mapping fixes for Linux 5.15	2021-10-20 10:16:51 -10:00
entry	entry: rseq: Call rseq_handle_notify_resume() in tracehook_notify_resume()	2021-09-22 10:24:01 -04:00
events	perf/core: fix userpage->time_enabled of inactive events	2021-10-01 13:57:54 +02:00
gcov	Kconfig: Introduce ARCH_WANTS_NO_INSTR and CC_HAS_NO_PROFILE_FN_ATTR	2021-06-22 11:07:18 -07:00
irq	PCI/MSI: Move non-mask check back into low level accessors	2021-11-18 19:17:14 +01:00
kcsan	LKMM updates:	2021-09-02 13:00:15 -07:00
livepatch	livepatch: Replace deprecated CPU-hotplug functions.	2021-08-19 12:00:24 +02:00
locking	lockdep: Let lock_is_held_type() detect recursive read as read	2021-11-18 19:16:23 +01:00
power	PM: hibernate: fix sparse warnings	2021-11-18 19:16:38 +01:00
printk	memblock: introduce saner 'memblock_free_ptr()' interface	2021-09-14 13:23:22 -07:00
rcu	rcu: Fix rcu_dynticks_curr_cpu_in_eqs() vs noinstr	2021-11-18 19:16:30 +01:00
sched	kernel/sched: Fix sched_fork() access an invalid sched_task_group	2021-11-18 19:16:32 +01:00
time	posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()	2021-11-18 19:17:14 +01:00
trace	tracing: Fix missing trace_boot_init_histograms kstrdup NULL checks	2021-11-18 19:16:41 +01:00
.gitignore	.gitignore: prefix local generated files with a slash	2021-05-02 00:43:35 +09:00
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	locking/rwlock: Provide RT variant	2021-08-17 17:50:51 +02:00
Kconfig.preempt	sched/core: Disable CONFIG_SCHED_CORE by default	2021-06-28 22:43:05 +02:00
Makefile	kbuild: update config_data.gz only when the content of .config is changed	2021-05-02 00:43:35 +09:00
acct.c	kernel/acct.c: use dedicated helper to access rlimit values	2021-09-08 11:50:26 -07:00
async.c	kernel/async.c: remove async_unregister_domain()	2021-05-07 00:26:33 -07:00
audit.c	lsm: separate security_task_getsecid() into subjective and objective variants	2021-03-22 15:23:32 -04:00
audit.h	audit: add header protection to kernel/audit.h	2021-07-19 22:38:24 -04:00
audit_fsnotify.c	audit_alloc_mark(): don't open-code ERR_CAST()	2021-02-23 10:25:27 -05:00
audit_tree.c	audit: move put_tree() to avoid trim_trees refcount underflow and UAF	2021-08-24 18:52:36 -04:00
audit_watch.c	fsnotify: generalize handle_inode_event()	2020-12-03 14:58:35 +01:00
auditfilter.c	lsm: separate security_task_getsecid() into subjective and objective variants	2021-03-22 15:23:32 -04:00
auditsc.c	audit: fix possible null-pointer dereference in audit_filter_rules	2021-10-18 18:27:47 -04:00
backtracetest.c	…
bounds.c	…
capability.c	capability: handle idmapped mounts	2021-01-24 14:27:16 +01:00
cfi.c	cfi: Use rcu_read_{un}lock_sched_notrace	2021-08-11 13:11:12 -07:00
compat.c	arch: remove compat_alloc_user_space	2021-09-08 15:32:35 -07:00
configs.c	…
context_tracking.c	…
cpu.c	cpu/hotplug: Add debug printks for hotplug callback failures	2021-08-10 18:31:32 +02:00
cpu_pm.c	PM: cpu: Make notifier chain use a raw_spinlock_t	2021-08-16 18:55:32 +02:00
crash_core.c	kdump: use vmlinux_build_id to simplify	2021-07-08 11:48:22 -07:00
crash_dump.c	…
cred.c	ucounts: Move get_ucounts from cred_alloc_blank to key_change_session_keyring	2021-10-20 10:34:20 -05:00
delayacct.c	delayacct: Add sysctl to enable at runtime	2021-05-12 11:43:25 +02:00
dma.c	…
exec_domain.c	…
exit.c	io_uring: remove files pointer in cancellation functions	2021-08-23 13:10:37 -06:00
extable.c	…
fail_function.c	fault-injection: handle EI_ETYPE_TRUE	2020-12-15 22:46:19 -08:00
fork.c	posix-cpu-timers: Clear task::posix_cputimers_work in copy_process()	2021-11-18 19:17:14 +01:00
freezer.c	sched: Add get_current_state()	2021-06-18 11:43:08 +02:00
futex.c	futex: Remove unused variable 'vpid' in futex_proxy_trylock_atomic()	2021-09-03 23:00:22 +02:00
gen_kheaders.sh	kbuild: clean up ${quiet} checks in shell scripts	2021-05-27 04:01:50 +09:00
groups.c	groups: simplify struct group_info allocation	2021-02-26 09:41:03 -08:00
hung_task.c	Merge branch 'akpm' (patches from Andrew)	2021-07-02 12:08:10 -07:00
iomem.c	…
irq_work.c	irq_work: Make irq_work_queue() NMI-safe again	2021-06-10 10:00:08 +02:00
jump_label.c	jump_label: Fix jump_label_text_reserved() vs __init	2021-07-05 10:46:20 +02:00
kallsyms.c	module: add printk formats to add module build ID to stacktraces	2021-07-08 11:48:22 -07:00
kcmp.c	Merge branch 'exec-update-lock-for-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2020-12-15 19:36:48 -08:00
kcov.c	…
kexec.c	kexec: avoid compat_alloc_user_space	2021-09-08 15:32:34 -07:00
kexec_core.c	Merge branch 'rework/printk_safe-removal' into for-linus	2021-08-30 16:36:10 +02:00
kexec_elf.c	…
kexec_file.c	kernel: kexec_file: fix error return code of kexec_calculate_store_digests()	2021-05-07 00:26:32 -07:00
kexec_internal.h	kexec: move machine_kexec_post_load() to public interface	2021-02-22 12:33:26 +00:00
kheaders.c	…
kmod.c	modules: add CONFIG_MODPROBE_PATH	2021-05-07 00:26:33 -07:00
kprobes.c	kprobes: Do not use local variable when creating debugfs file	2021-11-18 19:16:29 +01:00
ksysfs.c	…
kthread.c	Merge branch 'akpm' (patches from Andrew)	2021-06-29 17:29:11 -07:00
latencytop.c	…
module-internal.h	…
module.c	module: fix clang CFI with MODULE_UNLOAD=n	2021-09-28 12:56:26 +02:00
module_signature.c	module: harden ELF info handling	2021-01-19 10:24:45 +01:00
module_signing.c	module: harden ELF info handling	2021-01-19 10:24:45 +01:00
notifier.c	notifier: Remove atomic_notifier_call_chain_robust()	2021-08-16 18:55:32 +02:00
nsproxy.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
padata.c	padata: Remove repeated verbose license text	2021-08-27 16:30:18 +08:00
panic.c	Merge branch 'rework/printk_safe-removal' into for-linus	2021-08-30 16:36:10 +02:00
params.c	params: lift param_set_uint_minmax to common code	2021-08-16 14:42:22 +02:00
pid.c	kernel/pid.c: implement additional checks upon pidfd_create() parameters	2021-08-10 12:53:07 +02:00
pid_namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
profile.c	profiling: fix shift-out-of-bounds bugs	2021-09-08 11:50:26 -07:00
ptrace.c	sched: Change task_struct::state	2021-06-18 11:43:09 +02:00
range.c	…
reboot.c	reboot: Add hardware protection power-off	2021-06-21 13:08:36 +01:00
regset.c	…
relay.c	relay: allow the use of const callback structs	2020-12-15 22:46:18 -08:00
resource.c	kernel/resource: fix return code check in __request_free_mem_region	2021-05-14 19:41:32 -07:00
resource_kunit.c	resource: provide meaningful MODULE_LICENSE() in test suite	2020-11-25 18:52:35 +01:00
rseq.c	KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest	2021-09-22 10:24:01 -04:00
scftorture.c	scftorture: Avoid NULL pointer exception on early exit	2021-07-27 11:39:30 -07:00
scs.c	scs: Release kasan vmalloc poison in scs_free process	2021-11-18 19:16:29 +01:00
seccomp.c	Merge branch 'exit-cleanups-for-v5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2021-09-01 14:52:05 -07:00
signal.c	signal: Add SA_IMMUTABLE to ensure forced siganls do not get changed	2021-11-18 19:16:01 +01:00
smp.c	smp: Fix all kernel-doc warnings	2021-08-11 14:47:16 +02:00
smpboot.c	smpboot: Replace deprecated CPU-hotplug functions.	2021-08-10 14:57:42 +02:00
smpboot.h	…
softirq.c	genirq: Change force_irqthreads to a static key	2021-08-10 22:50:07 +02:00
stackleak.c	…
stacktrace.c	…
static_call.c	static_call: Fix static_call_text_reserved() vs __init	2021-07-05 10:46:33 +02:00
stop_machine.c	stop_machine: Add caller debug info to queue_stop_cpus_work	2021-03-23 16:01:58 +01:00
sys.c	Merge branch 'akpm' (patches from Andrew)	2021-09-08 12:55:35 -07:00
sys_ni.c	compat: remove some compat entry points	2021-09-08 15:32:35 -07:00
sysctl-test.c	kernel/sysctl-test: Remove some casts which are no-longer required	2021-06-23 16:41:24 -06:00
sysctl.c	Merge branch 'akpm' (patches from Andrew)	2021-09-03 10:08:28 -07:00
task_work.c	kasan: record task_work_add() call stack	2021-04-30 11:20:42 -07:00
taskstats.c	treewide: rename nla_strlcpy to nla_strscpy.	2020-11-16 08:08:54 -08:00
test_kprobes.c	…
torture.c	torture: Replace deprecated CPU-hotplug functions.	2021-08-10 10:48:07 -07:00
tracepoint.c	tracepoint: Fix kerneldoc comments	2021-08-16 11:39:51 -04:00
tsacct.c	…
ucount.c	ucounts: Fix signal ucount refcounting	2021-10-18 16:02:30 -05:00
uid16.c	…
uid16.h	…
umh.c	kernel/umh.c: fix some spelling mistakes	2021-05-07 00:26:34 -07:00
up.c	A set of locking related fixes and updates:	2021-05-09 13:07:03 -07:00
user-return-notifier.c	…
user.c	fs/epoll: use a per-cpu counter for user's watches count	2021-09-08 11:50:27 -07:00
user_namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
usermode_driver.c	Merge branch 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2021-07-03 11:41:14 -07:00
utsname.c	…
utsname_sysctl.c	…
watch_queue.c	watch_queue: rectify kernel-doc for init_watch()	2021-01-26 11:16:34 +00:00
watchdog.c	kernel: watchdog: modify the explanation related to watchdog thread	2021-06-29 10:53:46 -07:00
watchdog_hld.c	…
workqueue.c	workqueue: make sysfs of unbound kworker cpumask more clever	2021-11-18 19:16:17 +01:00
workqueue_internal.h	workqueue: Assign a color to barrier work items	2021-08-17 07:49:10 -10:00