Files
linux/include/linux
Christian Brauner 28aaa9c399 kthread: consolidate kthread exit paths to prevent use-after-free
Guillaume reported crashes via corrupted RCU callback function pointers
during KUnit testing. The crash was traced back to the pidfs rhashtable
conversion which replaced the 24-byte rb_node with an 8-byte rhash_head
in struct pid, shrinking it from 160 to 144 bytes.

struct kthread (without CONFIG_BLK_CGROUP) is also 144 bytes. With
CONFIG_SLAB_MERGE_DEFAULT and SLAB_HWCACHE_ALIGN both round up to
192 bytes and share the same slab cache. struct pid.rcu.func and
struct kthread.affinity_node both sit at offset 0x78.

When a kthread exits via make_task_dead() it bypasses kthread_exit() and
misses the affinity_node cleanup. free_kthread_struct() frees the memory
while the node is still linked into the global kthread_affinity_list. A
subsequent list_del() by another kthread writes through dangling list
pointers into the freed and reused memory, corrupting the pid's
rcu.func pointer.

Instead of patching free_kthread_struct() to handle the missed cleanup,
consolidate all kthread exit paths. Turn kthread_exit() into a macro
that calls do_exit() and add kthread_do_exit() which is called from
do_exit() for any task with PF_KTHREAD set. This guarantees that
kthread-specific cleanup always happens regardless of the exit path -
make_task_dead(), direct do_exit(), or kthread_exit().

Replace __to_kthread() with a new tsk_is_kthread() accessor in the
public header. Export do_exit() since module code using the
kthread_exit() macro now needs it directly.

Reported-by: Guillaume Tucker <gtucker@gtucker.io>
Tested-by: Guillaume Tucker <gtucker@gtucker.io>
Tested-by: Mark Brown <broonie@kernel.org>
Tested-by: David Gow <davidgow@google.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/all/20260224-mittlerweile-besessen-2738831ae7f6@brauner
Co-developed-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: 4d13f4304f ("kthread: Implement preferred affinity")
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-02-26 10:45:49 +01:00
..
2026-02-11 13:44:47 +01:00
2026-01-29 20:21:41 +01:00
2025-12-15 14:33:38 +01:00
2026-01-20 19:44:19 -08:00
2026-02-12 04:23:53 -07:00
2025-11-21 11:21:31 +01:00
2025-12-16 14:40:51 +01:00
2025-12-13 20:04:32 +12:00
2026-02-19 09:12:05 +01:00
2025-12-23 11:23:10 -08:00
2026-01-12 16:52:09 +01:00
2026-02-06 07:29:14 -07:00
2026-01-05 16:43:31 +01:00
2026-01-11 06:09:11 -10:00
2026-01-20 19:24:50 -08:00
2026-01-26 19:03:47 -08:00
2025-11-23 12:30:40 +01:00
2025-12-29 11:53:38 +01:00
2026-01-26 20:02:27 -08:00
2025-11-11 10:01:30 +01:00
2026-02-20 17:31:55 -05:00
2026-01-30 11:34:34 +00:00
2026-02-10 11:39:31 +01:00
2026-02-10 11:39:30 +01:00
2026-01-11 06:09:11 -10:00
2025-11-27 14:24:30 -08:00
2025-11-18 17:52:54 +01:00
2026-01-11 06:09:11 -10:00
2025-11-28 09:21:18 -07:00
2026-01-05 16:43:30 +01:00
2026-01-31 14:22:57 -08:00
2026-01-14 12:04:34 +01:00
2026-02-04 13:22:39 -08:00
2026-01-06 17:06:03 -08:00
2026-01-11 06:09:11 -10:00
2026-01-20 19:24:47 -08:00
2026-01-30 18:26:59 -08:00