Commit 91840be8 authored Mar 30, 2026 by Jiayuan Chen Committed by Thomas Gleixner May 11, 2026

irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT

On PREEMPT_RT, non-HARD irq_work runs in per-CPU kthreads via
run_irq_workd(), so irq_work_sync() uses rcuwait() to wait for BUSY==0.

After irq_work_single() clears BUSY via atomic_cmpxchg(), it still
dereferences @work for irq_work_is_hard() and rcuwait_wake_up().

An irq_work_sync() caller on another CPU that enters after BUSY is cleared
can observe BUSY==0 immediately, return, and free the work before those
accesses complete — causing a use-after-free.

Fix this by wrapping run_irq_workd() in guard(rcu)() so that the entire
irq_work_single() execution is within an RCU read-side critical
section. Then add synchronize_rcu() in irq_work_sync() after
rcuwait_wait_event() to ensure the caller waits for the RCU grace period
before returning, preventing premature frees.

Fixes: 81097968 ("irq_work: Allow irq_work_sync() to sleep if irq_work() no IRQ support.")
Suggested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260330073234.303732-1-jiayuan.chen@linux.dev

parent cefafbd5

kernel/irq_work.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -292,6 +292,12 @@ void irq_work_sync(struct irq_work *work)
		!arch_irq_work_has_interrupt()) {
		rcuwait_wait_event(&work->irqwait, !irq_work_is_busy(work),
		TASK_UNINTERRUPTIBLE);
		/*
		* Ensure irq_work_single() does not access @work
		* after removing IRQ_WORK_BUSY. It is always
		* accessed within a RCU-read section.
		*/
		synchronize_rcu();
		return;
		}

		@@ -302,6 +308,7 @@ EXPORT_SYMBOL_GPL(irq_work_sync);

		static void run_irq_workd(unsigned int cpu)
		{
		guard(rcu)();
		irq_work_run_list(this_cpu_ptr(&lazy_list));
		}