[PATCH] misc: issei: hold a task reference across kthread_stop()

[PATCH] misc: issei: hold a task reference across kthread_stop()

[Joas Antonio dos Santos]

issei_process_thread() returns on its own once it sees power_down
after the final reset:

	ret = issei_reset(idev);
	if (idev->power_down) {
		dev_dbg(&idev->dev, "Powering down\n");
		return 0;
	}

issei_stop() sets power_down, waits up to ISSEI_STOP_TIMEOUT_MSEC for
rst_state to become ISSEI_RST_STATE_DISABLED and then calls
kthread_stop() on idev->process_thread. Nothing holds a reference to
that task, so after the thread has exited its task_struct can be freed
before or while kthread_stop() uses it. The kthread_stop() kerneldoc
covers this case: if threadfn() may call kthread_exit() itself, the
caller must ensure task_struct can't go away. The result is a
use-after-free of the task_struct and of the struct kthread that
free_task() releases with it, both of which kthread_stop() touches.

On a normal power down, issei_reset() sets ISSEI_RST_STATE_DISABLED
and the thread returns right after, so its exit races with the
kthread_stop() call in issei_stop(). If hw_reset() fails during power
down, issei_reset() returns before setting ISSEI_RST_STATE_DISABLED,
the thread still returns, and issei_stop() waits the full timeout
before calling kthread_stop() on a thread that exited long before.

issei_stop() is called from the PCI shutdown, remove and system
suspend paths.

Take a reference right after kthread_run() and drop it with
kthread_stop_put().

Fixes: 7bd4b9991db2 ("issei: implement main thread and ham messages")
Cc: stable@vger.kernel.org
Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>
Assisted-by: Yaga Agent HackerSec Claude:claude-opus-5-5
---
Not tested on ISSEI hardware, I don't have a Lunar Lake or later
machine. Build-tested with W=1 (x86_64, INTEL_SSEI=m,
INTEL_SSEI_HW_HECI=m), clean.

To check the kthread side, I used a small test module that models
issei_stop(): the thread returns on its own, the caller waits 500ms
and then calls kthread_stop(). On a KASAN kernel this gives
"slab-use-after-free in kthread_stop" (the task freed via free_task()
from the RCU callback). With get_task_struct() + kthread_stop_put()
it is clean. With no wait before kthread_stop() I did not hit it in
3 runs, so the normal power down path is a narrow race. I have not
seen the hw_reset() failure case on real hardware.

This also applies on top of "issei: runtime power management, dma
and in-kernel interface" v2, with a one-line context change in the
include block. The thread still returns on power down after that
series.

 drivers/misc/issei/main.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/issei/main.c b/drivers/misc/issei/main.c
index 5987fb3402..bea286757c 100644
--- a/drivers/misc/issei/main.c
+++ b/drivers/misc/issei/main.c
@@ -7,6 +7,7 @@
 #include <linux/export.h>
 #include <linux/jiffies.h>
 #include <linux/kthread.h>
+#include <linux/sched/task.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
 
@@ -269,6 +270,8 @@ int issei_start(struct issei_device *idev)
 		dev_err(&idev->dev, "unable to create process thread. ret = %d\n", ret);
 		return ret;
 	}
+	/* the thread can exit on its own on power down, keep it for kthread_stop() */
+	get_task_struct(idev->process_thread);
 
 	issei_poke_process_thread(idev);
 	return 0;
@@ -291,6 +294,6 @@ void issei_stop(struct issei_device *idev)
 	wait_event_timeout(idev->wait_rst_state,
 			   (idev->rst_state == ISSEI_RST_STATE_DISABLED),
 			   msecs_to_jiffies(ISSEI_STOP_TIMEOUT_MSEC));
-	kthread_stop(idev->process_thread);
+	kthread_stop_put(idev->process_thread);
 }
 EXPORT_SYMBOL_GPL(issei_stop);