From 912616f142bfeb1dc41f40dbe7ce38331886a94a Mon Sep 17 00:00:00 2001
From: "Eric W. Biederman" <ebiederm@xmission.com>
Date: Wed, 5 Jan 2022 16:30:21 -0600
Subject: [PATCH] exit: Guarantee make_task_dead leaks the tsk when calling
 do_task_exit
Git-commit: 912616f142bfeb1dc41f40dbe7ce38331886a94a
Patch-mainline: v5.17-rc1
References: bsc#1207328

Change the task state to EXIT_DEAD and take an extra rcu_refernce
to guarantee the task will not be reaped and that it will not be
freed.

Link: https://lkml.kernel.org/r/YdUzjrLAlRiNLQp2@zeniv-ca.linux.org.uk
Pointed-out-by: Al Viro <viro@zeniv.linux.org.uk>
Fixes: 7f80a2fd7db9 ("exit: Stop poorly open coding do_task_dead in make_task_dead")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Michal Hocko <mhocko@suse.com>

---
 kernel/exit.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/exit.c b/kernel/exit.c
index 6c4b04531f17..db4eeb7fc680 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -885,6 +885,8 @@ void __noreturn make_task_dead(int signr)
 	if (unlikely(tsk->flags & PF_EXITING)) {
 		pr_alert("Fixing recursive fault but reboot is needed!\n");
 		futex_exit_recursive(tsk);
+		tsk->exit_state = EXIT_DEAD;
+		refcount_inc(&tsk->rcu_users);
 		do_task_dead();
 	}
 
-- 
2.35.3