From: "Mickaël Salaün" <mic@digikod.net>
To: Brendan Higgins <brendanhiggins@google.com>,
David Gow <davidgow@google.com>, Rae Moar <rmoar@google.com>,
Shuah Khan <skhan@linuxfoundation.org>
Cc: "Mickaël Salaün" <mic@digikod.net>,
"Alan Maguire" <alan.maguire@oracle.com>,
"Borislav Petkov" <bp@alien8.de>,
"Dave Hansen" <dave.hansen@linux.intel.com>,
"Eric W . Biederman" <ebiederm@xmission.com>,
"H . Peter Anvin" <hpa@zytor.com>,
"Ingo Molnar" <mingo@redhat.com>,
"James Morris" <jamorris@linux.microsoft.com>,
"Kees Cook" <keescook@chromium.org>,
"Luis Chamberlain" <mcgrof@kernel.org>,
"Madhavan T . Venkataraman" <madvenka@linux.microsoft.com>,
"Marco Pagani" <marpagan@redhat.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Sean Christopherson" <seanjc@google.com>,
"Stephen Boyd" <sboyd@kernel.org>,
"Thara Gopinath" <tgopinath@microsoft.com>,
"Thomas Gleixner" <tglx@linutronix.de>,
"Vitaly Kuznetsov" <vkuznets@redhat.com>,
"Zahra Tarkhani" <ztarkhani@microsoft.com>,
kunit-dev@googlegroups.com, kvm@vger.kernel.org,
linux-hardening@vger.kernel.org, linux-hyperv@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-um@lists.infradead.org, x86@kernel.org
Subject: [PATCH v4 RESEND 2/7] kunit: Fix kthread reference
Date: Mon, 8 Apr 2024 09:46:20 +0200 [thread overview]
Message-ID: <20240408074625.65017-3-mic@digikod.net> (raw)
In-Reply-To: <20240408074625.65017-1-mic@digikod.net>
There is a race condition when a kthread finishes after the deadline and
before the call to kthread_stop(), which may lead to use after free.
Cc: Brendan Higgins <brendanhiggins@google.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Fixes: adf505457032 ("kunit: fix UAF when run kfence test case test_gfpzero")
Reviewed-by: David Gow <davidgow@google.com>
Reviewed-by: Rae Moar <rmoar@google.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net
---
Changes since v2:
* Add Fixes tag as suggested by David.
* Add David's and Rae's Reviewed-by.
Changes since v1:
* Add Kees's Reviewed-by.
---
lib/kunit/try-catch.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c
index a5cb2ef70a25..73f5007f20ea 100644
--- a/lib/kunit/try-catch.c
+++ b/lib/kunit/try-catch.c
@@ -11,6 +11,7 @@
#include <linux/completion.h>
#include <linux/kernel.h>
#include <linux/kthread.h>
+#include <linux/sched/task.h>
#include "try-catch-impl.h"
@@ -65,14 +66,15 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
try_catch->context = context;
try_catch->try_completion = &try_completion;
try_catch->try_result = 0;
- task_struct = kthread_run(kunit_generic_run_threadfn_adapter,
- try_catch,
- "kunit_try_catch_thread");
+ task_struct = kthread_create(kunit_generic_run_threadfn_adapter,
+ try_catch, "kunit_try_catch_thread");
if (IS_ERR(task_struct)) {
try_catch->try_result = PTR_ERR(task_struct);
try_catch->catch(try_catch->context);
return;
}
+ get_task_struct(task_struct);
+ wake_up_process(task_struct);
time_remaining = wait_for_completion_timeout(&try_completion,
kunit_test_timeout());
@@ -82,6 +84,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context)
kthread_stop(task_struct);
}
+ put_task_struct(task_struct);
exit_code = try_catch->try_result;
if (!exit_code)
--
2.44.0
next prev parent reply other threads:[~2024-04-08 7:47 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-08 7:46 [PATCH v4 RESEND 0/7] Handle faults in KUnit tests Mickaël Salaün
2024-04-08 7:46 ` [PATCH v4 RESEND 1/7] kunit: Handle thread creation error Mickaël Salaün
2024-04-08 7:46 ` Mickaël Salaün [this message]
2024-04-08 7:46 ` [PATCH v4 RESEND 3/7] kunit: Fix timeout message Mickaël Salaün
2024-04-08 7:46 ` [PATCH v4 RESEND 4/7] kunit: Handle test faults Mickaël Salaün
2024-04-08 7:46 ` [PATCH v4 RESEND 5/7] kunit: Fix KUNIT_SUCCESS() calls in iov_iter tests Mickaël Salaün
2024-04-08 7:46 ` [PATCH v4 RESEND 6/7] kunit: Print last test location on fault Mickaël Salaün
2024-04-08 7:46 ` [PATCH v4 RESEND 7/7] kunit: Add tests for fault Mickaël Salaün
2024-04-09 17:28 ` [PATCH v4 RESEND 0/7] Handle faults in KUnit tests Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240408074625.65017-3-mic@digikod.net \
--to=mic@digikod.net \
--cc=alan.maguire@oracle.com \
--cc=bp@alien8.de \
--cc=brendanhiggins@google.com \
--cc=dave.hansen@linux.intel.com \
--cc=davidgow@google.com \
--cc=ebiederm@xmission.com \
--cc=hpa@zytor.com \
--cc=jamorris@linux.microsoft.com \
--cc=keescook@chromium.org \
--cc=kunit-dev@googlegroups.com \
--cc=kvm@vger.kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-hyperv@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linux-um@lists.infradead.org \
--cc=madvenka@linux.microsoft.com \
--cc=marpagan@redhat.com \
--cc=mcgrof@kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=rmoar@google.com \
--cc=sboyd@kernel.org \
--cc=seanjc@google.com \
--cc=skhan@linuxfoundation.org \
--cc=tglx@linutronix.de \
--cc=tgopinath@microsoft.com \
--cc=vkuznets@redhat.com \
--cc=x86@kernel.org \
--cc=ztarkhani@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).