[PATCH 0/2] genirq: fix use-after-free on abnormal IRQ thread exit

[Richard Patel]

When a threaded IRQ handler oopses on x86, the IRQ thread jumps to a
function pointer read from freed stack memory. This turned a benign oops
(NULL dereference) into a wild jump on Panther Lake with FRED.

This series fixes two lifetime bugs in the abnormal exit path of IRQ
threads:

1) irq_thread() stores a 'struct callback_head' (for exit_task_work())
   on its stack, but the oops handler runs rewind_stack_and_make_dead()
   before exit_task_work() runs.

2) A concurrent free_irq() and threaded IRQ oops can result in
   free_irq() calling kfree(struct irqaction) before irq_thread_dtor()
   runs in exit_task_work().

Whether this stack use-after-free causes a loud crash (wild jump) or
not probably depends on kernel config and FRED, since callback_head
might not get clobbered always.

I have some evidence of these use-after-free in the wild going back to
Linux 4.20, these are all variations of double faults in an IRQ thread's
exit_task_work().

* 2026-09 (confirmed)
  * my Panther Lake laptop on recent x86 tip :-)
  * 7.3.0+: Second fault in task_work_run, wild jump, IBT violation
* 2026-06 (confirmed)
  * https://github.com/CachyOS/linux-cachyos/issues/882
  * https://lore.kernel.org/r/CAFb0CM1X8_rxdfJGM-1D6i0=KDtv9tbMbuWi+PKAhTSMT+5NnA@xxxxxxxxxxxxxx
  * 7.1.0-2-cachyos: Second fault in task_work_run, wild jump, IBT violation
  * 7.1.0-1-mainline: Second fault in task_work_run, wild jump, NX violation
* 2024-07 (confirmed)
  * https://bbs.archlinux.org/viewtopic.php?id=297634
  * 6.9.9-arch: Second fault in task_work_run, wild jump to middle of
                exit_shm, #PF
* 2024-05 (almost certain)
  * https://lore.kernel.org/r/cover.1714762038.git.namcao@xxxxxxxxxxxxx
  * 6.8.6 (QEMU): Second fault in task_work_run, wild jump to NULL pointer
* 2023-01 (unsure)
  * https://bugzilla.kernel.org/show_bug.cgi?id=216865
  * 6.2-rc1 (Fedora): Second fault in irq_thread_dtor, GPF
* 2020-10 (likely)
  * https://lore.kernel.org/r/a45db8d2-6902-7ec7-cab2-1436209a15a6@xxxxxxxxx
  * 5.9.0: Second fault in task_work_run, wild jump to NULL pointer
* 2019-02 (unsure)
  * https://lore.kernel.org/r/524648a9-3fb9-1423-aa1a-376289fafc5d@xxxxxxxxx
  * 4.20.11 (Arch): Second fault in irq_thread_dtor, function call to NULL

And a few more which look sus but I'm too lazy to hand triage:
* https://github.com/CachyOS/linux-cachyos/issues/1027
  * "the fault recovery itself triggers a second, more severe oops
    (attempted execution of a non-executable page)"
* https://github.com/t2linux/T2-Debian-and-Ubuntu-Kernel/issues/215
  * double oops / page fault on IRQ thread exit
* https://github.com/Dasharo/dasharo-issues/issues/1849
  * wild jump on IRQ thread exit
* https://github.com/thesofproject/linux/issues/2676
  * double oops, task_work_run+0x6e jump to NULL
* https://github.com/thesofproject/linux/issues/820
  https://github.com/thesofproject/linux/issues/767
  * double oops, task_work_run jump to NULL
* https://github.com/libthinkpad/dockd/issues/3
  * double oops, task_work_run jump to heap address
* https://github.com/AMDESE/AMDSEV/issues/109
  * double oops, task_work_run jump to middle of do_exit, crash in a
    random mutex
* https://github.com/Askannz/optimus-manager/issues/176
  * double oops, task_work_run jump to middle of do_exit

Richard Patel (2):
  genirq: defer kfree(irqaction) until irq_thread_dtor() finishes
  genirq: move IRQ thread exit_work object to irqaction

 include/linux/interrupt.h |  2 ++
 kernel/irq/internals.h    |  2 ++
 kernel/irq/manage.c       | 30 +++++++++++++++++++++---------
 3 files changed, 25 insertions(+), 9 deletions(-)

-- 
2.52.0