Linux plugs UAF holes in POSIX CPU timers on non-leader exec

Thomas Gleixner has posted a second-round set of kernel fixes for use-after-free bugs and pending-signal list corruption in POSIX CPU timers, triggered when a non-leader thread calls exec.

The flaws were found by Hyunwoo Kim. POSIX CPU timers aimed at a specific task hold a PID reference used to look that task up later. On non-leader exec, the kernel swaps TIDs between the old and new group leader. Those PID references then resolve to the wrong task, or to none at all. Timers can still fire or be torn down while their queue nodes sit on a live or already-freed task, producing KASAN use-after-free reports and corrupted signal lists.

One failure path lets a timer signal re-queue onto a task whose pending list is being flushed during exit, racing a non-atomic list delete so the entry is never fully unlinked and is touched after the timer object is freed. Another leaves timer nodes queued on the surviving thread after the PID ownership change; if exec fails past the point of no return, exit frees the timer while the node is still linked, and later reaping walks freed memory.

The fixes refuse to queue per-task signals once PF_EXITING is set, take the sighand lock when setting that flag, and flush per-task signals immediately in exit handling. Exec-time POSIX CPU timer cleanup now runs right after the thread-group handoff so leftover nodes are gone before timers are deleted. Timer teardown itself moves earlier in exit, once the task can no longer expire CPU timers, rather than waiting until final release.

The changes keep timer_create, settime, gettime, and delete appearing to work for as long as a task remains visible, avoiding a user-visible behaviour shift, while stopping pointless enqueue once exit has begun. Reviewers including Frederic Weisbecker, Oleg Nesterov, and Peter Zijlstra probed remaining ordering edge cases around the TID swap and lockless list flush; Gleixner argues existing sighand and tasklist release ordering already closes the window the third-party timer expiry path can observe.