linux/kernel/time
Linus Torvalds 0a15ba6b0c Timer race fixes:
- Fix timer signal <-> exec() race, to prevent UAF (Thomas Gleixner)
 
  - Clean up POSIX CPU timers right after de_thread(), to prevent UAF
    (Hyunwoo Kim)
 
  - Fix POSIX CPU timers race between expiry and timer_settime(),
    to prevent UAF (Thomas Gleixner)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqvrMYRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gqUQ/+NkruN984bFynF/eZ0/2DFv91AAUP8zgH
 /S3PBlwuSbYFN9JVhngDMwxQkamE56weJbFc+0QuvVT5UVw/vX9BS4QOvvzN+f8D
 FEN3UqD0d1B8OwlPNTw0sFPwJDdPctTinfKOhNjNQe6RLFsNARvGyaKDIDroWTfV
 dxuJ/7Ecs+5m1bmGJnPEC+IH/OnV9BEEl1NdZb+INKpBlui9LCsw4rRIj/8dPK/H
 UNhvXpykKrJCDftbCzAFSNryuzcJgq4kHtMbsqiUL6y50AB69eHGi/Y0xYBAEr1h
 NiDPq2PAMmH1NCCMsTtqbJZMqgCr+7DSZiCFn7bZPwg0V5tV4PFZD484q0sCbiej
 Fwg+arHd0icnceIcWMsBWPUVOSLxZaWdp9a2Tj3Ill06//b5bEDBJBbpecS+so3t
 8W6IvdoCYm7sz50mohnjOdx7biHPu0yhwgj+EoAV3nZKoALQAAcI7+HJzSWpGnJi
 HIO0zylRAZCjk9H3QNWO+LdWgifc8DysAZOWpmbuwGgp8q483IDRDtme/kMt3+D1
 1qTHa1TD/tPo8UmmgyVJQ7e1hCxBkGuuBBu5Y3/qkUEOQM6B/H2Ji7stxsLpW3JL
 HLzC3kL2SBBVBO2ljqiH5IhVAL10Qm5vPxaCOjExdBt1vjMxN1DowZqD4rT/tw58
 ArpD4zmr8VQ=
 =KhWJ
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer race fixes from Ingo Molnar:

 - Fix timer signal <-> exec() race, to prevent UAF (Thomas Gleixner)

 - Clean up POSIX CPU timers right after de_thread(), to prevent UAF
   (Hyunwoo Kim)

 - Fix POSIX CPU timers race between expiry and timer_settime(),
   to prevent UAF (Thomas Gleixner)

* tag 'timers-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
  exec: Cleanup POSIX timers right after de_thread()
  signal: Prevent exec() race
2026-09-20 09:41:00 -07:00
..
.kunitconfig time/kunit: Add .kunitconfig 2026-02-24 08:41:51 +01:00
alarmtimer.c alarmtimer: Remove stale return description from alarm_handle_timer() 2026-05-06 08:33:08 +02:00
clockevents.c tick/broadcast: Plug clockevents replacement race 2026-09-07 11:10:20 +02:00
clocksource-wdtest.c clocksource: Rewrite watchdog code completely 2026-03-20 13:36:32 +01:00
clocksource.c clocksource: Unregister subsystem on device registration failure 2026-07-07 23:26:58 +02:00
hrtimer.c hrtimer: Use hard expiry when updating timers on the same base 2026-09-11 10:15:42 +02:00
itimer.c timers/itimer: Zero-init old itimerval before copy to userspace 2026-08-11 15:43:12 +02:00
jiffies.c sysctl: Fix type truncation in sysctl_msec_to_jiffies 2026-09-15 09:20:58 +02:00
Kconfig nohz: Replace dead select with choice default 2026-08-11 15:37:23 +02:00
Makefile timens: Remove dependency on the vDSO 2026-03-26 15:44:23 +01:00
namespace_internal.h timens: Remove dependency on the vDSO 2026-03-26 15:44:23 +01:00
namespace_vdso.c vdso/datastore: Explicitly prevent remote access to timens vvar page 2026-07-07 23:52:52 +02:00
namespace.c time/namespace: Validate nanosecond field in proc_timens_set_offset() 2026-07-07 23:26:58 +02:00
ntp_internal.h timekeeping: Drive time_offset skew via per-tick ntp_error transfer 2026-07-10 09:20:54 +02:00
ntp.c ntp: Remove tick_length_base, use tick_length directly 2026-07-10 09:20:55 +02:00
posix-clock.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
posix-cpu-timers.c posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list 2026-09-19 22:56:22 +02:00
posix-stubs.c posix-timers: Get rid of [COMPAT_]SYS_NI() uses 2023-12-20 21:30:27 -08:00
posix-timers.c posix-timers: Switch to hrtimer_start_expires_user() 2026-05-01 21:36:12 +02:00
posix-timers.h posix-timers: Expand timer_[re]arm() callbacks with a boolean return value 2026-05-01 21:36:11 +02:00
sched_clock.c time/sched_clock: Use ACCESS_PRIVATE() to evaluate hrtimer::function 2026-01-13 18:08:57 +01:00
sleep_timeout.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
test_udelay.c time: Add MODULE_DESCRIPTION() to time test modules 2024-06-03 11:18:50 +02:00
tick-broadcast-hrtimer.c clockevents: Remove redundant CLOCK_EVT_FEAT_KTIME 2026-02-27 16:40:06 +01:00
tick-broadcast.c tick/broadcast: Plug clockevents replacement race 2026-09-07 11:10:20 +02:00
tick-common.c clockevents: Prevent timer interrupt starvation 2026-04-10 22:45:38 +02:00
tick-internal.h tick/broadcast: Plug clockevents replacement race 2026-09-07 11:10:20 +02:00
tick-legacy.c timekeeping: remove xtime_update 2020-10-30 21:57:07 +01:00
tick-oneshot.c treewide: Update email address 2026-01-11 06:09:11 -10:00
tick-sched.c tick: Remove arch_needs_cpu 2026-07-08 17:03:28 +02:00
tick-sched.h tick/sched: Remove unused fields 2026-06-02 21:27:25 +02:00
time_test.c time/kunit: Document handling of negative years of is_leap() 2026-02-02 12:37:54 +01:00
time.c VDSO updates: 2026-08-18 16:56:25 -07:00
timeconst.bc time: Add SPDX license identifiers 2018-11-23 11:51:20 +01:00
timeconv.c time: Improve performance of time64_to_tm() 2021-06-24 11:51:59 +02:00
timecounter.c time/timecounter: Inline timecounter_cyc2time() 2025-12-15 20:16:49 +01:00
timekeeping_debug.c timekeeping: Add percpu counter for tracking floor swap events 2024-10-10 10:20:46 +02:00
timekeeping_internal.h timekeeping: Move the vDSO update declarations into a private header 2026-07-07 23:48:08 +02:00
timekeeping.c timekeeping: Use u32 for clock_was_set_seq 2026-08-11 18:11:20 +02:00
timekeeping.h timekeeping: Use u32 for clock_was_set_seq 2026-08-11 18:11:20 +02:00
timer_list.c timer_list: Use ktime_t over nanoseconds 2026-08-11 18:11:20 +02:00
timer_migration.c timers/migration: Fix memory leak in tmigr_setup_groups() error path 2026-07-07 23:26:58 +02:00
timer_migration.h timers/migration: Fix bad line kernel-doc warning in struct tmigr_cpu 2026-07-20 16:07:39 +02:00
timer.c timer: Keep debugobjects state consistent in migrate_timer_list() 2026-08-18 10:51:43 +02:00
vsyscall.c vdso/vsyscall: Avoid slow division loop in auxiliary clock update 2025-09-03 11:55:11 +02:00