tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

Null pointer deref with hrtimer_try_to_cancel()

Impact: Prevent kernel crash with posix timer clockid CLOCK_MONOTONIC_RAW

commit 2d42244ae71d6c7b0884b5664cf2eda30fb2ae68 (clocksource:
introduce CLOCK_MONOTONIC_RAW) introduced a new clockid, which is only
available to read out the raw not NTP adjusted system time.

The above commit did not prevent that a posix timer can be created
with that clockid. The timer_create() syscall succeeds and initializes
the timer to a non existing hrtimer base. When the timer is deleted
either by timer_delete() or by the exit() cleanup the kernel crashes.

Prevent the creation of timers for CLOCK_MONOTONIC_RAW by setting the
posix clock function to no_timer_create which returns an error code.

Reported-and-tested-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Thomas Gleixner and committed by
Linus Torvalds 3d44cc3e ab653872

+6
+6
kernel/posix-timers.c
··· 197 197 return 0; 198 198 } 199 199 200 + static int no_timer_create(struct k_itimer *new_timer) 201 + { 202 + return -EOPNOTSUPP; 203 + } 204 + 200 205 /* 201 206 * Return nonzero if we know a priori this clockid_t value is bogus. 202 207 */ ··· 253 248 .clock_getres = hrtimer_get_res, 254 249 .clock_get = posix_get_monotonic_raw, 255 250 .clock_set = do_posix_clock_nosettime, 251 + .timer_create = no_timer_create, 256 252 }; 257 253 258 254 register_posix_clock(CLOCK_REALTIME, &clock_realtime);