From 8ccd731b63a0183ca2b0e18f3ca15864b3f37eda Mon Sep 17 00:00:00 2001 From: "Cen Zhang (Microsoft)" Date: Mon, 12 Oct 2026 19:51:49 -0400 Subject: [PATCH] posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() signal path do_cpu_nanosleep() sleeps on a temporary k_itimer whose reference on the target's struct pid is taken by posix_cpu_timer_create() and dropped by posix_cpu_timer_del(). When a signal ends the sleep, the timer is disarmed with posix_cpu_timer_set(), but posix_cpu_timer_del() is only called for a result of 0 or TIMER_RETRY. If the target thread or process has exited in the meantime, timer_lock_sighand() finds no task, posix_cpu_timer_set() returns -ESRCH and the pid reference is leaked. An unprivileged user can trigger this: sleep on the CPU clock of a thread, let that thread exit, then signal the sleeper. Each round leaks one struct pid. Repeating it exhausts unreclaimable slab memory within minutes: Out of memory: Killed process 150 (poc) total-vm:789292kB, anon-rss:484kB Kernel panic - not syncing: System is deadlocked on memory Fix this by also calling posix_cpu_timer_del() on -ESRCH. With the target gone, the deletion is safe. It finds no task either and only drops the pid reference. Fixes: e26d70d271ee ("posix-timers: Cleanup reaped target handling") Reported-by: AutonomousCodeSecurity@microsoft.com Signed-off-by: Cen Zhang (Microsoft) Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261012235149.66531-1-cenzhang@linux.microsoft.com --- kernel/time/posix-cpu-timers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c index 0bf4fcd969c8..65cc612046d1 100644 --- a/kernel/time/posix-cpu-timers.c +++ b/kernel/time/posix-cpu-timers.c @@ -1600,8 +1600,8 @@ static int do_cpu_nanosleep(const clockid_t which_clock, int flags, */ expires = cpu_timer_getexpires(&timer.it.cpu); error = posix_cpu_timer_set(&timer, 0, &zero_it, &it); - if (!error) { - /* Timer is now unarmed, deletion can not fail. */ + if (error != TIMER_RETRY) { + /* Unarmed or target gone (-ESRCH), deletion can not fail. */ posix_cpu_timer_del(&timer); } else { while (error == TIMER_RETRY) {