diff options
| author | Linus Torvalds <[email protected]> | 2024-09-12 13:11:10 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2024-09-12 13:11:10 -0700 |
| commit | 5da028864fde4856398f9dfb922aa0545dbad271 (patch) | |
| tree | 30061f385420324d93711639de617cf2f35b0c9e | |
| parent | 8581ae1ea0d203a71851b21455c2d5167ba00e50 (diff) | |
| parent | 73613840a8896f4f859eea489cb4a7a656939e70 (diff) | |
Merge tag 'wq-for-6.11-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
Pull workqueue fix from Tejun Heo:
"A fix for a NULL worker->pool deref bug which can be triggered when a
worker is created and then destroyed immediately"
* tag 'wq-for-6.11-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
workqueue: Clear worker->pool in the worker thread context
| -rw-r--r-- | kernel/workqueue.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/kernel/workqueue.c b/kernel/workqueue.c index e7b005ff3750..6f2545037e57 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -2709,7 +2709,6 @@ static void detach_worker(struct worker *worker) unbind_worker(worker); list_del(&worker->node); - worker->pool = NULL; } /** @@ -2729,6 +2728,7 @@ static void worker_detach_from_pool(struct worker *worker) mutex_lock(&wq_pool_attach_mutex); detach_worker(worker); + worker->pool = NULL; mutex_unlock(&wq_pool_attach_mutex); /* clear leftover flags without pool->lock after it is detached */ @@ -3349,7 +3349,11 @@ woke_up: if (unlikely(worker->flags & WORKER_DIE)) { raw_spin_unlock_irq(&pool->lock); set_pf_worker(false); - + /* + * The worker is dead and PF_WQ_WORKER is cleared, worker->pool + * shouldn't be accessed, reset it to NULL in case otherwise. + */ + worker->pool = NULL; ida_free(&pool->worker_ida, worker->id); return 0; } |