Commit 9f005933 authored by Mickaël Salaün's avatar Mickaël Salaün Committed by Guo Mengqi
Browse files

kunit: Fix kthread reference 

mainline inclusion
from mainline-v6.10-rc1
commit f8aa1b98ce40184521ed95ec26cc115a255183b2
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SDW
CVE: CVE-2024-38561

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f8aa1b98ce40184521ed95ec26cc115a255183b2



--------------------------------

There is a race condition when a kthread finishes after the deadline and
before the call to kthread_stop(), which may lead to use after free.

Cc: Brendan Higgins <brendanhiggins@google.com>
Cc: Shuah Khan <skhan@linuxfoundation.org>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Fixes: adf50545 ("kunit: fix UAF when run kfence test case test_gfpzero")
Reviewed-by: default avatarDavid Gow <davidgow@google.com>
Reviewed-by: default avatarRae Moar <rmoar@google.com>
Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
Link: https://lore.kernel.org/r/20240408074625.65017-3-mic@digikod.net


Signed-off-by: default avatarShuah Khan <skhan@linuxfoundation.org>

Conflicts:
	lib/kunit/try-catch.c
[Context conflicts]
Signed-off-by: default avatarZhangPeng <zhangpeng362@huawei.com>
parent 12511146

lib/kunit/try-catch.c

+6 −3
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include <linux/completion.h>

#include <linux/kernel.h>

#include <linux/kthread.h>

#include <linux/sched/task.h>



#include "try-catch-impl.h"
@@ -65,13 +66,14 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) 
	try_catch->context = context;

	try_catch->try_completion = &try_completion;

	try_catch->try_result = 0;

	task_struct = kthread_run(kunit_generic_run_threadfn_adapter,

				  try_catch,

				  "kunit_try_catch_thread");

	task_struct = kthread_create(kunit_generic_run_threadfn_adapter,

				     try_catch, "kunit_try_catch_thread");

	if (IS_ERR(task_struct)) {

		try_catch->catch(try_catch->context);

		return;

	}

	get_task_struct(task_struct);

	wake_up_process(task_struct);



	time_remaining = wait_for_completion_timeout(&try_completion,

						     kunit_test_timeout());
@@ -81,6 +83,7 @@ void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) 
		kthread_stop(task_struct);

	}



	put_task_struct(task_struct);

	exit_code = try_catch->try_result;



	if (!exit_code)