* [PATCH] workqueue: Fix an use after free in init_rescuer()
@ 2020-05-08 15:07 Dan Carpenter
2020-05-10 10:33 ` Lai Jiangshan
2020-05-11 14:27 ` Tejun Heo
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2020-05-08 15:07 UTC (permalink / raw)
To: Tejun Heo, Sean Fu; +Cc: Lai Jiangshan, linux-kernel, kernel-janitors
We need to preserve error code before freeing "rescuer".
Fixes: f187b6974f6df ("workqueue: Use IS_ERR and PTR_ERR instead of PTR_ERR_OR_ZERO.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Another option would be to just revert the original commit.
kernel/workqueue.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index ddf0537dce140..10ed8d761e0b7 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4197,6 +4197,7 @@ static int wq_clamp_max_active(int max_active, unsigned int flags,
static int init_rescuer(struct workqueue_struct *wq)
{
struct worker *rescuer;
+ int ret;
if (!(wq->flags & WQ_MEM_RECLAIM))
return 0;
@@ -4208,8 +4209,9 @@ static int init_rescuer(struct workqueue_struct *wq)
rescuer->rescue_wq = wq;
rescuer->task = kthread_create(rescuer_thread, rescuer, "%s", wq->name);
if (IS_ERR(rescuer->task)) {
+ ret = PTR_ERR(rescuer->task);
kfree(rescuer);
- return PTR_ERR(rescuer->task);
+ return ret;
}
wq->rescuer = rescuer;
--
2.26.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] workqueue: Fix an use after free in init_rescuer()
2020-05-08 15:07 [PATCH] workqueue: Fix an use after free in init_rescuer() Dan Carpenter
@ 2020-05-10 10:33 ` Lai Jiangshan
2020-05-11 14:27 ` Tejun Heo
1 sibling, 0 replies; 3+ messages in thread
From: Lai Jiangshan @ 2020-05-10 10:33 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Tejun Heo, Sean Fu, LKML, kernel-janitors
Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
On Fri, May 8, 2020 at 11:07 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> We need to preserve error code before freeing "rescuer".
>
> Fixes: f187b6974f6df ("workqueue: Use IS_ERR and PTR_ERR instead of PTR_ERR_OR_ZERO.")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Another option would be to just revert the original commit.
>
> kernel/workqueue.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> index ddf0537dce140..10ed8d761e0b7 100644
> --- a/kernel/workqueue.c
> +++ b/kernel/workqueue.c
> @@ -4197,6 +4197,7 @@ static int wq_clamp_max_active(int max_active, unsigned int flags,
> static int init_rescuer(struct workqueue_struct *wq)
> {
> struct worker *rescuer;
> + int ret;
>
> if (!(wq->flags & WQ_MEM_RECLAIM))
> return 0;
> @@ -4208,8 +4209,9 @@ static int init_rescuer(struct workqueue_struct *wq)
> rescuer->rescue_wq = wq;
> rescuer->task = kthread_create(rescuer_thread, rescuer, "%s", wq->name);
> if (IS_ERR(rescuer->task)) {
> + ret = PTR_ERR(rescuer->task);
> kfree(rescuer);
> - return PTR_ERR(rescuer->task);
> + return ret;
> }
>
> wq->rescuer = rescuer;
> --
> 2.26.2
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] workqueue: Fix an use after free in init_rescuer()
2020-05-08 15:07 [PATCH] workqueue: Fix an use after free in init_rescuer() Dan Carpenter
2020-05-10 10:33 ` Lai Jiangshan
@ 2020-05-11 14:27 ` Tejun Heo
1 sibling, 0 replies; 3+ messages in thread
From: Tejun Heo @ 2020-05-11 14:27 UTC (permalink / raw)
To: Dan Carpenter; +Cc: Sean Fu, Lai Jiangshan, linux-kernel, kernel-janitors
On Fri, May 08, 2020 at 06:07:40PM +0300, Dan Carpenter wrote:
> We need to preserve error code before freeing "rescuer".
>
> Fixes: f187b6974f6df ("workqueue: Use IS_ERR and PTR_ERR instead of PTR_ERR_OR_ZERO.")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied to wq/for-5.8. Thank you.
--
tejun
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-05-11 14:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-08 15:07 [PATCH] workqueue: Fix an use after free in init_rescuer() Dan Carpenter
2020-05-10 10:33 ` Lai Jiangshan
2020-05-11 14:27 ` Tejun Heo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).