Re: [tip: timers/urgent] posix-cpu-timers: Prevent UAF caused by non-leader exec() race

[Oleg Nesterov]

On 07/08, Thomas Gleixner wrote:
>
> On Wed, Jul 08 2026 at 18:43, Oleg Nesterov wrote:
>
> > On 07/08, Frederic Weisbecker wrote:
> >>
> >> > There is a similar problem vs. posix_cpu_timer_set(). For regular posix
> >> > timers it just transiently returns -ESRCH to user space, but for the use
> >> > case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is
> >> > allocated on the stack.
> >>
> >> do_cpu_nanosleep() only targets current and since it's on the stack, no
> >> other task can access it. And the current task can't be exiting/exec'ing
> >> while calling posix_cpu_timer_set() on that stack timer.
> >
> > I thought the same initially, but it seems that this is not true...
>
> Indeed.

OK,

> > Or why else we have clock_getcpuclockid() ?
>
> To express which thread or thread group the sleep should be on. It's
> exactly the same as timer_create() + timer_set(). It sleeps until that
> clock accumulated enough runtime, while regular posix-timers either wait
> for a signal or handle it async.

This is what I tried to say, sorry for possible confusion.

Oleg.