[PATCH 0/2] genirq: fix use-after-free on abnormal IRQ thread exit

[PATCH 0/2] genirq: fix use-after-free on abnormal IRQ thread exit

[Richard Patel]

When a threaded IRQ handler oopses on x86, the IRQ thread jumps to a
function pointer read from freed stack memory. This turned a benign oops
(NULL dereference) into a wild jump on Panther Lake with FRED.

This series fixes two lifetime bugs in the abnormal exit path of IRQ
threads:

1) irq_thread() stores a 'struct callback_head' (for exit_task_work())
   on its stack, but the oops handler runs rewind_stack_and_make_dead()
   before exit_task_work() runs.

2) A concurrent free_irq() and threaded IRQ oops can result in
   free_irq() calling kfree(struct irqaction) before irq_thread_dtor()
   runs in exit_task_work().

Whether this stack use-after-free causes a loud crash (wild jump) or
not probably depends on kernel config and FRED, since callback_head
might not get clobbered always.

I have some evidence of these use-after-free in the wild going back to
Linux 4.20, these are all variations of double faults in an IRQ thread's
exit_task_work().

* 2026-09 (confirmed)
  * my Panther Lake laptop on recent x86 tip :-)
  * 7.3.0+: Second fault in task_work_run, wild jump, IBT violation
* 2026-06 (confirmed)
  * https://github.com/CachyOS/linux-cachyos/issues/882
  * https://lore.kernel.org/r/CAFb0CM1X8_rxdfJGM-1D6i0=KDtv9tbMbuWi+PKAhTSMT+5NnA@mail.gmail.com
  * 7.1.0-2-cachyos: Second fault in task_work_run, wild jump, IBT violation
  * 7.1.0-1-mainline: Second fault in task_work_run, wild jump, NX violation
* 2024-07 (confirmed)
  * https://bbs.archlinux.org/viewtopic.php?id=297634
  * 6.9.9-arch: Second fault in task_work_run, wild jump to middle of
                exit_shm, #PF
* 2024-05 (almost certain)
  * https://lore.kernel.org/r/cover.1714762038.git.namcao@linutronix.de
  * 6.8.6 (QEMU): Second fault in task_work_run, wild jump to NULL pointer
* 2023-01 (unsure)
  * https://bugzilla.kernel.org/show_bug.cgi?id=216865
  * 6.2-rc1 (Fedora): Second fault in irq_thread_dtor, GPF
* 2020-10 (likely)
  * https://lore.kernel.org/r/a45db8d2-6902-7ec7-cab2-1436209a15a6@gmail.com
  * 5.9.0: Second fault in task_work_run, wild jump to NULL pointer
* 2019-02 (unsure)
  * https://lore.kernel.org/r/524648a9-3fb9-1423-aa1a-376289fafc5d@gmail.com
  * 4.20.11 (Arch): Second fault in irq_thread_dtor, function call to NULL

And a few more which look sus but I'm too lazy to hand triage:
* https://github.com/CachyOS/linux-cachyos/issues/1027
  * "the fault recovery itself triggers a second, more severe oops
    (attempted execution of a non-executable page)"
* https://github.com/t2linux/T2-Debian-and-Ubuntu-Kernel/issues/215
  * double oops / page fault on IRQ thread exit
* https://github.com/Dasharo/dasharo-issues/issues/1849
  * wild jump on IRQ thread exit
* https://github.com/thesofproject/linux/issues/2676
  * double oops, task_work_run+0x6e jump to NULL
* https://github.com/thesofproject/linux/issues/820
  https://github.com/thesofproject/linux/issues/767
  * double oops, task_work_run jump to NULL
* https://github.com/libthinkpad/dockd/issues/3
  * double oops, task_work_run jump to heap address
* https://github.com/AMDESE/AMDSEV/issues/109
  * double oops, task_work_run jump to middle of do_exit, crash in a
    random mutex
* https://github.com/Askannz/optimus-manager/issues/176
  * double oops, task_work_run jump to middle of do_exit

Richard Patel (2):
  genirq: defer kfree(irqaction) until irq_thread_dtor() finishes
  genirq: move IRQ thread exit_work object to irqaction

 include/linux/interrupt.h |  2 ++
 kernel/irq/internals.h    |  2 ++
 kernel/irq/manage.c       | 30 +++++++++++++++++++++---------
 3 files changed, 25 insertions(+), 9 deletions(-)

-- 
2.52.0

[PATCH 1/2] genirq: defer kfree(irqaction) until irq_thread_dtor() finishes

[Richard Patel]

When an IRQ thread exits abnormally via do_exit() (e.g. the IRQ
handler oopses) without returning from irq_thread(), a concurrent
call to free_irq() could free the irqaction before the
irq_thread_dtor() exit task work runs.

  irq thread (oopsed)                 free_irq()
  -------------------                 ----------
  do_exit()
    exit_mm()
      complete_vfork_done()  -------> kthread_stop() returns
    exit_files() ...                  kfree(action)
    exit_task_work()
      irq_thread_dtor()
        action->...                   <- use-after-free

Track the pending exit work with the IRQTF_EXIT_WORK thread flag,
and have __free_irq() wait for the bit to clear before kfree().

irq_thread_dtor() only runs on irq_thread abnormal exit. If that
dtor also faults, free_irq() will hang indefinitely, but double
IRQ thread faults require a reboot anyways.

Fixes: ed3e694d78cc ("move exit_task_work() past exit_files() et.al.")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Patel <ripatel@wii.dev>
---
 kernel/irq/internals.h |  2 ++
 kernel/irq/manage.c    | 25 +++++++++++++++++++------
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 0ce21dd45404..2c30e7537987 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -36,6 +36,7 @@ extern struct irqaction chained_action;
  * IRQTF_AFFINITY  - irq thread is requested to adjust affinity
  * IRQTF_FORCED_THREAD  - irq action is force threaded
  * IRQTF_READY     - signals that irq thread is ready
+ * IRQTF_EXIT_WORK - irq thread exit task_work is pending
  */
 enum {
 	IRQTF_RUNTHREAD,
@@ -43,6 +44,7 @@ enum {
 	IRQTF_AFFINITY,
 	IRQTF_FORCED_THREAD,
 	IRQTF_READY,
+	IRQTF_EXIT_WORK,
 };
 
 /*
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 57eff26fa646..e882a0693a39 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1176,17 +1176,14 @@ void wake_threads_waitq(struct irq_desc *desc)
 		wake_up(&desc->wait_for_threads);
 }
 
-static void irq_thread_dtor(struct callback_head *unused)
+static void __irq_thread_dtor(struct irqaction *action)
 {
 	struct task_struct *tsk = current;
 	struct irq_desc *desc;
-	struct irqaction *action;
 
 	if (WARN_ON_ONCE(!(current->flags & PF_EXITING)))
 		return;
 
-	action = kthread_data(tsk);
-
 	pr_err("exiting task \"%s\" (%d) is an active IRQ thread (irq %d)\n",
 	       tsk->comm, tsk->pid, action->irq);
 
@@ -1203,6 +1200,14 @@ static void irq_thread_dtor(struct callback_head *unused)
 	irq_finalize_oneshot(desc, action);
 }
 
+static void irq_thread_dtor(struct callback_head *unused)
+{
+	struct irqaction *action = kthread_data(current);
+
+	__irq_thread_dtor(action);
+	clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
+}
+
 static void irq_wake_secondary(struct irq_desc *desc, struct irqaction *action)
 {
 	struct irqaction *secondary = action->secondary;
@@ -1263,6 +1268,7 @@ static int irq_thread(void *data)
 	else
 		handler_fn = irq_thread_fn;
 
+	set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
 	init_task_work(&on_exit_work, irq_thread_dtor);
 	task_work_add(current, &on_exit_work, TWA_NONE);
 
@@ -1283,6 +1289,7 @@ static int irq_thread(void *data)
 	 * oneshot mask bit can be set.
 	 */
 	task_work_cancel_func(current, irq_thread_dtor);
+	clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
 	return 0;
 }
 
@@ -1853,6 +1860,12 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
 	return ret;
 }
 
+static void irq_stop_thread(struct irqaction *action)
+{
+	kthread_stop_put(action->thread);
+	wait_on_bit(&action->thread_flags, IRQTF_EXIT_WORK, TASK_UNINTERRUPTIBLE);
+}
+
 /*
  * Internal function to unregister an irqaction - used to free
  * regular and special interrupts that are part of the architecture.
@@ -1958,9 +1971,9 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
 	 * the same bit to a newly requested action.
 	 */
 	if (action->thread) {
-		kthread_stop_put(action->thread);
+		irq_stop_thread(action);
 		if (action->secondary && action->secondary->thread)
-			kthread_stop_put(action->secondary->thread);
+			irq_stop_thread(action->secondary);
 	}
 
 	/* Last action releases resources */
-- 
2.52.0

[PATCH 2/2] genirq: move IRQ thread exit_work object to irqaction

[Richard Patel]

irq_thread() registers irq_thread_dtor() as exit task_work using
a stack-allocated callback_head.  On normal IRQ thread exit, this
work gets cancelled and never runs.

On x86, an abnormal IRQ thread exit (e.g. handler oops) discards
the stack, including the callback_head, while that callback_head
is still pending. By the time exit_task_work() runs, the stack
memory formerly backing callback_head is already clobbered.

  irq_thread()                      <-- on_exit_work allocated
    ** IRQ handler faults **
    oops_end()
      rewind_stack_and_make_dead()  <-- on_exit_work freed
  make_task_dead()
    do_exit(SIGSEGV)
      ...
      exit_shm()                    <-- on_exit_work clobbered
      ...
      exit_task_work()              <-- stack use-after-free
        exit_shm()+0x30             <-- wild jump to return addr

Thus, a benign threaded IRQ oops (e.g. a NULL pointer deref) is
turned into a wild jump. This is caught by kernel IBT:

  ** first fault **
  Oops: general protection fault, kernel NULL pointer dereference 0x3c0: 0000 [#1] SMP NOPTI
  ...
  ** second fault **
  Missing ENDBR: exit_shm+0x30/0x1c0
  kernel BUG at arch/x86/kernel/cet.c:133!
  ...
   ? task_work_run+0x5c/0x90
   ? do_exit+0x209/0x460
   ? rewind_stack_and_make_dead+0x16/0x20
  ...
  note: irq/165-AudioDS[1427] exited with irqs disabled
  Fixing recursive fault but reboot is needed!

Fix this by storing the callback_head in struct irqaction.
The irqaction is only freed once irq_thread_dtor() finishes.

Fixes: 2deb4be28077 ("x86/dumpstack: When OOPSing, rewind the stack before do_exit()")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Patel <ripatel@wii.dev>
---
 include/linux/interrupt.h | 2 ++
 kernel/irq/manage.c       | 9 ++++-----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 52bb684090c0..ee2dd5349697 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -119,6 +119,7 @@ typedef irqreturn_t (*irq_handler_t)(int, void *);
  * @thread_flags:	flags related to @thread
  * @thread_mask:	bitmask for keeping track of @thread activity
  * @dir:	pointer to the proc/irq/NN/name entry
+ * @thread_dtor:	task_work for @thread irregular exit cleanup
  */
 struct irqaction {
 	irq_handler_t		handler;
@@ -137,6 +138,7 @@ struct irqaction {
 	unsigned long		thread_mask;
 	const char		*name;
 	struct proc_dir_entry	*dir;
+	struct callback_head	thread_dtor;
 } ____cacheline_internodealigned_in_smp;
 
 extern irqreturn_t no_action(int cpl, void *dev_id);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index e882a0693a39..4fbb8f960dbf 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1200,9 +1200,9 @@ static void __irq_thread_dtor(struct irqaction *action)
 	irq_finalize_oneshot(desc, action);
 }
 
-static void irq_thread_dtor(struct callback_head *unused)
+static void irq_thread_dtor(struct callback_head *work)
 {
-	struct irqaction *action = kthread_data(current);
+	struct irqaction *action = container_of(work, struct irqaction, thread_dtor);
 
 	__irq_thread_dtor(action);
 	clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
@@ -1249,7 +1249,6 @@ static void wake_up_and_wait_for_irq_thread_ready(struct irq_desc *desc,
  */
 static int irq_thread(void *data)
 {
-	struct callback_head on_exit_work;
 	struct irqaction *action = data;
 	struct irq_desc *desc = irq_to_desc(action->irq);
 	irqreturn_t (*handler_fn)(struct irq_desc *desc,
@@ -1269,8 +1268,8 @@ static int irq_thread(void *data)
 		handler_fn = irq_thread_fn;
 
 	set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
-	init_task_work(&on_exit_work, irq_thread_dtor);
-	task_work_add(current, &on_exit_work, TWA_NONE);
+	init_task_work(&action->thread_dtor, irq_thread_dtor);
+	task_work_add(current, &action->thread_dtor, TWA_NONE);
 
 	while (!irq_wait_for_interrupt(desc, action)) {
 		irqreturn_t action_ret;
-- 
2.52.0