diff options
| author | Richard Clark <richard.xnu.clark@gmail.com> | 2022-12-13 12:39:36 +0800 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2023-01-04 12:25:29 -1000 |
| commit | 33e3f0a3358b8f9bb54b2661b9c1d37a75664c79 (patch) | |
| tree | a8e81fcbbdf813c1322c8c8b7156ac9e52650da5 /kernel/workqueue.c | |
| parent | 512dee0c00ad9e9c7ae9f11fc6743702ea40caff (diff) | |
| download | linux-33e3f0a3358b8f9bb54b2661b9c1d37a75664c79.tar.gz | |
workqueue: Add a new flag to spot the potential UAF error
Currently if the user queues a new work item unintentionally
into a wq after the destroy_workqueue(wq), the work still can
be queued and scheduled without any noticeable kernel message
before the end of a RCU grace period.
As a debug-aid facility, this commit adds a new flag
__WQ_DESTROYING to spot that issue by triggering a kernel WARN
message.
Signed-off-by: Richard Clark <richard.xnu.clark@gmail.com>
Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'kernel/workqueue.c')
| -rw-r--r-- | kernel/workqueue.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 07895deca2711a..5b06262a419ca3 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -1433,9 +1433,13 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, lockdep_assert_irqs_disabled(); - /* if draining, only works from the same workqueue are allowed */ - if (unlikely(wq->flags & __WQ_DRAINING) && - WARN_ON_ONCE(!is_chained_work(wq))) + /* + * For a draining wq, only works from the same workqueue are + * allowed. The __WQ_DESTROYING helps to spot the issue that + * queues a new work item to a wq after destroy_workqueue(wq). + */ + if (unlikely(wq->flags & (__WQ_DESTROYING | __WQ_DRAINING) && + WARN_ON_ONCE(!is_chained_work(wq)))) return; rcu_read_lock(); retry: @@ -4414,6 +4418,11 @@ void destroy_workqueue(struct workqueue_struct *wq) */ workqueue_sysfs_unregister(wq); + /* mark the workqueue destruction is in progress */ + mutex_lock(&wq->mutex); + wq->flags |= __WQ_DESTROYING; + mutex_unlock(&wq->mutex); + /* drain it before proceeding with destruction */ drain_workqueue(wq); |