* [PATCH 1/2] genirq: defer kfree(irqaction) until irq_thread_dtor() finishes
2026-10-09 14:58 [PATCH 0/2] genirq: fix use-after-free on abnormal IRQ thread exit Richard Patel
@ 2026-10-09 14:58 ` Richard Patel
2026-10-09 14:58 ` [PATCH 2/2] genirq: move IRQ thread exit_work object to irqaction Richard Patel
1 sibling, 0 replies; 3+ messages in thread
From: Richard Patel @ 2026-10-09 14:58 UTC (permalink / raw)
To: Thomas Gleixner
Cc: linux-kernel, Marc Zyngier, Sebastian Andrzej Siewior,
Ingo Molnar, Andy Lutomirski, Josh Poimboeuf, Al Viro,
Charles Keepax, David Rubin, PJ Waskiewicz
When an IRQ thread exits abnormally via do_exit() (e.g. the IRQ
handler oopses) without returning from irq_thread(), a concurrent
call to free_irq() could free the irqaction before the
irq_thread_dtor() exit task work runs.
irq thread (oopsed) free_irq()
------------------- ----------
do_exit()
exit_mm()
complete_vfork_done() -------> kthread_stop() returns
exit_files() ... kfree(action)
exit_task_work()
irq_thread_dtor()
action->... <- use-after-free
Track the pending exit work with the IRQTF_EXIT_WORK thread flag,
and have __free_irq() wait for the bit to clear before kfree().
irq_thread_dtor() only runs on irq_thread abnormal exit. If that
dtor also faults, free_irq() will hang indefinitely, but double
IRQ thread faults require a reboot anyways.
Fixes: ed3e694d78cc ("move exit_task_work() past exit_files() et.al.")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Patel <ripatel@wii.dev>
---
kernel/irq/internals.h | 2 ++
kernel/irq/manage.c | 25 +++++++++++++++++++------
2 files changed, 21 insertions(+), 6 deletions(-)
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index 0ce21dd45404..2c30e7537987 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -36,6 +36,7 @@ extern struct irqaction chained_action;
* IRQTF_AFFINITY - irq thread is requested to adjust affinity
* IRQTF_FORCED_THREAD - irq action is force threaded
* IRQTF_READY - signals that irq thread is ready
+ * IRQTF_EXIT_WORK - irq thread exit task_work is pending
*/
enum {
IRQTF_RUNTHREAD,
@@ -43,6 +44,7 @@ enum {
IRQTF_AFFINITY,
IRQTF_FORCED_THREAD,
IRQTF_READY,
+ IRQTF_EXIT_WORK,
};
/*
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 57eff26fa646..e882a0693a39 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1176,17 +1176,14 @@ void wake_threads_waitq(struct irq_desc *desc)
wake_up(&desc->wait_for_threads);
}
-static void irq_thread_dtor(struct callback_head *unused)
+static void __irq_thread_dtor(struct irqaction *action)
{
struct task_struct *tsk = current;
struct irq_desc *desc;
- struct irqaction *action;
if (WARN_ON_ONCE(!(current->flags & PF_EXITING)))
return;
- action = kthread_data(tsk);
-
pr_err("exiting task \"%s\" (%d) is an active IRQ thread (irq %d)\n",
tsk->comm, tsk->pid, action->irq);
@@ -1203,6 +1200,14 @@ static void irq_thread_dtor(struct callback_head *unused)
irq_finalize_oneshot(desc, action);
}
+static void irq_thread_dtor(struct callback_head *unused)
+{
+ struct irqaction *action = kthread_data(current);
+
+ __irq_thread_dtor(action);
+ clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
+}
+
static void irq_wake_secondary(struct irq_desc *desc, struct irqaction *action)
{
struct irqaction *secondary = action->secondary;
@@ -1263,6 +1268,7 @@ static int irq_thread(void *data)
else
handler_fn = irq_thread_fn;
+ set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
init_task_work(&on_exit_work, irq_thread_dtor);
task_work_add(current, &on_exit_work, TWA_NONE);
@@ -1283,6 +1289,7 @@ static int irq_thread(void *data)
* oneshot mask bit can be set.
*/
task_work_cancel_func(current, irq_thread_dtor);
+ clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
return 0;
}
@@ -1853,6 +1860,12 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new)
return ret;
}
+static void irq_stop_thread(struct irqaction *action)
+{
+ kthread_stop_put(action->thread);
+ wait_on_bit(&action->thread_flags, IRQTF_EXIT_WORK, TASK_UNINTERRUPTIBLE);
+}
+
/*
* Internal function to unregister an irqaction - used to free
* regular and special interrupts that are part of the architecture.
@@ -1958,9 +1971,9 @@ static struct irqaction *__free_irq(struct irq_desc *desc, void *dev_id)
* the same bit to a newly requested action.
*/
if (action->thread) {
- kthread_stop_put(action->thread);
+ irq_stop_thread(action);
if (action->secondary && action->secondary->thread)
- kthread_stop_put(action->secondary->thread);
+ irq_stop_thread(action->secondary);
}
/* Last action releases resources */
--
2.52.0
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH 2/2] genirq: move IRQ thread exit_work object to irqaction
2026-10-09 14:58 [PATCH 0/2] genirq: fix use-after-free on abnormal IRQ thread exit Richard Patel
2026-10-09 14:58 ` [PATCH 1/2] genirq: defer kfree(irqaction) until irq_thread_dtor() finishes Richard Patel
@ 2026-10-09 14:58 ` Richard Patel
1 sibling, 0 replies; 3+ messages in thread
From: Richard Patel @ 2026-10-09 14:58 UTC (permalink / raw)
To: Thomas Gleixner
Cc: linux-kernel, Marc Zyngier, Sebastian Andrzej Siewior,
Ingo Molnar, Andy Lutomirski, Josh Poimboeuf, Al Viro,
Charles Keepax, David Rubin, PJ Waskiewicz
irq_thread() registers irq_thread_dtor() as exit task_work using
a stack-allocated callback_head. On normal IRQ thread exit, this
work gets cancelled and never runs.
On x86, an abnormal IRQ thread exit (e.g. handler oops) discards
the stack, including the callback_head, while that callback_head
is still pending. By the time exit_task_work() runs, the stack
memory formerly backing callback_head is already clobbered.
irq_thread() <-- on_exit_work allocated
** IRQ handler faults **
oops_end()
rewind_stack_and_make_dead() <-- on_exit_work freed
make_task_dead()
do_exit(SIGSEGV)
...
exit_shm() <-- on_exit_work clobbered
...
exit_task_work() <-- stack use-after-free
exit_shm()+0x30 <-- wild jump to return addr
Thus, a benign threaded IRQ oops (e.g. a NULL pointer deref) is
turned into a wild jump. This is caught by kernel IBT:
** first fault **
Oops: general protection fault, kernel NULL pointer dereference 0x3c0: 0000 [#1] SMP NOPTI
...
** second fault **
Missing ENDBR: exit_shm+0x30/0x1c0
kernel BUG at arch/x86/kernel/cet.c:133!
...
? task_work_run+0x5c/0x90
? do_exit+0x209/0x460
? rewind_stack_and_make_dead+0x16/0x20
...
note: irq/165-AudioDS[1427] exited with irqs disabled
Fixing recursive fault but reboot is needed!
Fix this by storing the callback_head in struct irqaction.
The irqaction is only freed once irq_thread_dtor() finishes.
Fixes: 2deb4be28077 ("x86/dumpstack: When OOPSing, rewind the stack before do_exit()")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Patel <ripatel@wii.dev>
---
include/linux/interrupt.h | 2 ++
kernel/irq/manage.c | 9 ++++-----
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 52bb684090c0..ee2dd5349697 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -119,6 +119,7 @@ typedef irqreturn_t (*irq_handler_t)(int, void *);
* @thread_flags: flags related to @thread
* @thread_mask: bitmask for keeping track of @thread activity
* @dir: pointer to the proc/irq/NN/name entry
+ * @thread_dtor: task_work for @thread irregular exit cleanup
*/
struct irqaction {
irq_handler_t handler;
@@ -137,6 +138,7 @@ struct irqaction {
unsigned long thread_mask;
const char *name;
struct proc_dir_entry *dir;
+ struct callback_head thread_dtor;
} ____cacheline_internodealigned_in_smp;
extern irqreturn_t no_action(int cpl, void *dev_id);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index e882a0693a39..4fbb8f960dbf 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1200,9 +1200,9 @@ static void __irq_thread_dtor(struct irqaction *action)
irq_finalize_oneshot(desc, action);
}
-static void irq_thread_dtor(struct callback_head *unused)
+static void irq_thread_dtor(struct callback_head *work)
{
- struct irqaction *action = kthread_data(current);
+ struct irqaction *action = container_of(work, struct irqaction, thread_dtor);
__irq_thread_dtor(action);
clear_and_wake_up_bit(IRQTF_EXIT_WORK, &action->thread_flags);
@@ -1249,7 +1249,6 @@ static void wake_up_and_wait_for_irq_thread_ready(struct irq_desc *desc,
*/
static int irq_thread(void *data)
{
- struct callback_head on_exit_work;
struct irqaction *action = data;
struct irq_desc *desc = irq_to_desc(action->irq);
irqreturn_t (*handler_fn)(struct irq_desc *desc,
@@ -1269,8 +1268,8 @@ static int irq_thread(void *data)
handler_fn = irq_thread_fn;
set_bit(IRQTF_EXIT_WORK, &action->thread_flags);
- init_task_work(&on_exit_work, irq_thread_dtor);
- task_work_add(current, &on_exit_work, TWA_NONE);
+ init_task_work(&action->thread_dtor, irq_thread_dtor);
+ task_work_add(current, &action->thread_dtor, TWA_NONE);
while (!irq_wait_for_interrupt(desc, action)) {
irqreturn_t action_ret;
--
2.52.0
^ permalink raw reply [flat|nested] 3+ messages in thread