Repository navigation
Conversation
scheduler_dp_internal_free() freed the event and thread objects, removed memory domain partitions and deinitialized the memory domain using pointers read from task_memory. That memory is in the module heap, which user threads can write, and the validator did not check mod->mdom at all. A caller could make the kernel free arbitrary kernel objects or operate on a forged memory domain. Record the event, thread, memory domain, partitions and component id in kernel memory when the DP task is created. The free path, including the syscall, now only uses the task pointer as a lookup key, and rejects unknown or already freed tasks. Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
kv2019i
requested review from
LaurentiuM1234,
dbaluta,
marcinszkudlinski and
pblaszko
as code owners
October 26, 2026 16:30
kv2019i
requested review from
abonislawski,
lgirdwood,
softwarecki and
wjablon1
and
a balanced review from Copilot
and removed request for
LaurentiuM1234,
dbaluta,
marcinszkudlinski and
pblaszko
October 26, 2026 16:30
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Teardown removes caller authorization checks and still follows user-writable allocator metadata in privileged context.
2 open issues
What changed in this PR
This PR hardens DP scheduler teardown by recording kernel-object ownership outside user-writable task memory.
Changes:
- Adds a kernel-only task registry protected by a spinlock.
- Uses recorded objects, domain partitions, and component IDs during cleanup.
- Rejects unknown or already-freed task pointers and adds allocation-failure cleanup for records.
| File | Description |
|---|---|
src/schedule/zephyr_dp_schedule_application.c |
Adds trusted task records and routes teardown through registry lookup. |
Review effort: Balanced
| k_object_free(kobj->thread); | ||
| scheduler_dp_domain_free(kobj->mod, kobj->mdom, kobj->mpart, kobj->comp_id); | ||
|
|
||
| mod_free(kobj->mod, container_of(task, struct scheduler_dp_task_memory, task)); |
| * Do not read task->priv_data: everything needed comes from the | ||
| * kernel-only record, and an unknown task pointer is rejected. | ||
| */ | ||
| K_OOPS(!scheduler_dp_internal_free_kobj(task)); |
PR 11360: test resultsRun date: 2026-10-26 18:02 UTC Tested commit: 2d0e980434088b49ec5be58ec9dbba9807d4f929
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
scheduler_dp_internal_free() freed the event and thread objects, removed memory domain partitions and deinitialized the memory domain using pointers read from task_memory. That memory is in the module heap, which user threads can write, and the validator did not check mod->mdom at all. A caller could make the kernel free arbitrary kernel objects or operate on a forged memory domain.
Record the event, thread, memory domain, partitions and component id in kernel memory when the DP task is created. The free path, including the syscall, now only uses the task pointer as a lookup key, and rejects unknown or already freed tasks.