Kernel fixes UAFs in POSIX CPU timers on non-leader exec

Thomas Gleixner has posted fixes for two use-after-free bugs in the Linux kernel's POSIX CPU timer handling, both triggered when a non-leader thread calls exec.

The problems were found by Hyunwoo Kim. POSIX CPU timers aimed at a specific thread hold a PID reference used to look the target up later. Non-leader exec rearranges the thread group and swaps TIDs between the old leader and the caller, so those references no longer name the task the timer was attached to.

In one case a timer signal could still be delivered after the original target was released. A non-atomic check of whether the signal was already queued raced with list cleanup, leaving a corrupted entry on a live thread's pending list. A later tgkill then walked into memory that had already been freed by RCU. In the other, a timer node stayed queued on the surviving thread while the timer itself was deleted; if exec failed after the point of no return, exit freed the structure and reaping later erased the dangling node from the timer queue.

The fixes refuse to queue per-task signals on a task already marked exiting, take the sighand lock around that flag, and flush those signals at that point. Timer cleanup for exec now runs immediately after the thread-group rearrange, before later failure paths can reach exit with timers still attached. Gleixner also moved the ordinary exit-path cleanup earlier: once a task is exiting it no longer expires CPU timers, so leaving them queued until final release served no purpose. Timers remain reachable from userspace for as long as the PID is still hashed, preserving the previous observable lifetime.

The changes close the windows that produced the KASAN reports without altering the user-visible contract for POSIX timers.