Repository navigation
Conversation
The validators of zephyr_ll_task_sem_alloc() and _free() checked that task->priv_data points to user-writable memory, but the implementation read the pointer again from the user-owned task. A thread on another core could swap it in between, and the kernel would then write the new semaphore pointer to an address of its choice. Copy priv_data once with k_usermode_from_copy() in the validator and pass the validated pointer to the implementation. Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
kv2019i
requested review from
LaurentiuM1234,
dbaluta,
marcinszkudlinski and
pblaszko
as code owners
October 23, 2026 10:07
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
Both syscall paths consistently use the captured, validated pointer, with no unresolved findings.
No open issues 🎉
What changed in this PR
This PR closes a user-memory pointer race in the Zephyr low-latency scheduler’s semaphore syscalls by ensuring the validated priv_data pointer is the one used by the implementation.
Changes:
- Copy
task->priv_dataonce in a shared validator and validate the captured pointer. - Pass that pointer directly to allocation and free helpers while preserving kernel-call behavior.
| File | Description |
|---|---|
src/schedule/zephyr_ll.c |
Refactors semaphore helpers and validators to avoid rereading the user-controlled pointer. |
Review effort: Balanced
lgirdwood
approved these changes
Oct 23, 2026
PR 11343: test resultsRun date: 2026-10-23 11:22 UTC Tested commit: 7a7e037854e01974dfeb25559888bd20fed42066
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The validators of zephyr_ll_task_sem_alloc() and _free() checked that task->priv_data points to user-writable memory, but the implementation read the pointer again from the user-owned task. A thread on another core could swap it in between, and the kernel would then write the new semaphore pointer to an address of its choice.
Copy priv_data once with k_usermode_from_copy() in the validator and pass the validated pointer to the implementation.