Re: [PATCH v2] exit: hold a reference to thread_pid across proc_flush_pid

[Bradley Morgan <brads@mainlining.org>]

On 31 August 2026 01:12:21 BST, Daehyeon Ko <4ncienth@gmail.com> wrote:
>Commit 0a36bad01731 ("release_task: kill the no longer needed
>get/put_pid(thread_pid)") removed the reference around proc_flush_pid().
>It assumed that free_pids(post.pids) at the end of release_task() would
>keep thread_pid alive until then.
>
>That assumption is wrong.  __change_pid() only records a detached PID in
>post.pids when pid_has_task() is false for every PIDTYPE.  If another task
>still uses the exiting task's PID as its process group or session ID,
>__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves
>the PID out of post.pids.  release_task() therefore holds no reference to
>it after dropping tasklist_lock.
>
>The other task can then remove the remaining PIDTYPE links.  Its
>free_pids() call schedules delayed_put_pid(), and the RCU callback can
>free
>the PID before the first release_task() reaches proc_flush_pid().
>
>An unprivileged reproducer races wait4(-1) against setsid() to trigger
>this

Gnarly!

>ordering.  Three of three fresh v7.2 KASAN boots reported:
>
>    BUG: KASAN: slab-use-after-free in
>    proc_invalidate_siblings_dcache+0x3e2/0x3f0
>    Read of size 8 by task h7_pid_reaper/1921
>
>    Call Trace:
>     proc_invalidate_siblings_dcache
>     release_task
>     wait_consider_task
>     __do_wait
>     do_wait
>     kernel_wait4
>
>    Freed by task 0:
>     kmem_cache_free
>     put_pid
>     delayed_put_pid
>     rcu_core
>
>    Last potentially related work creation:
>     __call_rcu_common
>     free_pids
>     ksys_setsid
>
>KASAN identified a 144-byte object from the pid cache and located the bad
>read 80 bytes into the freed object, matching pid->inodes.  With an
>explicit reference, three of three fresh boots completed without a KASAN
>report.  The concurrent RCU callback dropped its reference while
>proc_flush_pid() was protected, and the balancing put_pid() performed the
>final free afterward.
>

Ok

>Take a reference before __unhash_process() clears p->thread_pid and
>release
>it after proc_flush_pid() completes.
>
>A tested source reproducer is available privately on request.  No
>controlled read or write, information leak, or privilege escalation is
>claimed.  The mainline patch applies directly to v6.19.y and newer;
>v6.16.y through v6.18.y need a context-adjusted backport.
>
>Fixes: 0a36bad01731 ("release_task: kill the no longer needed get/put_pid(thread_pid)")
>Reported-by: syzbot+0aee5e8066eddbbe7397@syzkaller.appspotmail.com
>Closes: https://syzkaller.appspot.com/bug?extid=0aee5e8066eddbbe7397
>Reported-by: syzbot+e8b3520b53e78e90034e@syzkaller.appspotmail.com
>Link: https://syzkaller.appspot.com/bug?extid=e8b3520b53e78e90034e
>Cc: <stable@vger.kernel.org> # see patch description, needs adjustments for 6.16.y-6.18.y
>Assisted-by: LLM

Thanks,

Reviewed-by: Bradley Morgan <brads@mainlining.org>


>Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
>---
>Changes in v2:
>- Rewrite the root-cause explanation around __change_pid(), pid_has_task(),
>  and the last PIDTYPE detach, as requested by Oleg.
>- Explain in the source comment why thread_pid needs an explicit reference.
>- Rebase onto current Torvalds master cee9395acd80.
>
> kernel/exit.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
>diff --git a/kernel/exit.c b/kernel/exit.c
>index 97686af89501..4e028f157597 100644
>--- a/kernel/exit.c
>+++ b/kernel/exit.c
>@@ -261,8 +261,11 @@ void release_task(struct task_struct *p)
> 	pidfs_exit(p);
> 	cgroup_task_release(p);
> 
>-	/* Retrieve @thread_pid before __unhash_process() may set it to NULL. */
>-	thread_pid = task_pid(p);
>+	/*
>+	 * Pin @thread_pid before __unhash_process() clears it. The last
>+	 * PIDTYPE detach can otherwise free it before proc_flush_pid().
>+	 */
>+	thread_pid = get_pid(task_pid(p));
> 
> 	write_lock_irq(&tasklist_lock);
> 	ptrace_release_task(p);
>@@ -291,8 +294,8 @@ void release_task(struct task_struct *p)
> 	}
> 
> 	write_unlock_irq(&tasklist_lock);
>-	/* @thread_pid can't go away until free_pids() below */
> 	proc_flush_pid(thread_pid);
>+	put_pid(thread_pid);
> 	exit_cred_namespaces(p);
> 	add_device_randomness(&p->se.sum_exec_runtime,
> 			      sizeof(p->se.sum_exec_runtime));
>
>base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
>

--- Thanks!
https://lore.kernel.org/all/EE579805-42F2-4C58-B752-F28779EEB717@grrlz.net/