niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

workqueue: Fixes for v6.14-rc2

Browse source 
- Fix a regression where a worker pool can be freed before rescuer workers
   are done with it leading to user-after-free.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCZ691oQ4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGUJ9AP9+fR3J07+0TzAtQmDzBRsJeIjx7zgM9hE2OVgR
 L5jvDgEAmzfEmHTaDYI097T3yM6o1se+e9nRKgwMvru0ZXT48wo=
 =eAo4
 -----END PGP SIGNATURE-----

Merge tag 'wq-for-6.14-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

Pull workqueue fix from Tejun Heo:

 - Fix a regression where a worker pool can be freed before rescuer
   workers are done with it leading to user-after-free

* tag 'wq-for-6.14-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  workqueue: Put the pwq after detaching the rescuer from the pool
This commit is contained in:
Linus Torvalds 2025-02-14 10:58:03 -08:00
commit f4d4680965
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
kernel/workqueue.c
View file

@ -3516,12 +3516,6 @@ repeat:
}
}
/*
* Put the reference grabbed by send_mayday(). @pool won't
* go away while we're still attached to it.
*/
put_pwq(pwq);
/*
* Leave this pool. Notify regular workers; otherwise, we end up
* with 0 concurrency and stalling the execution.
@ -3532,6 +3526,12 @@ repeat:
worker_detach_from_pool(rescuer);
/*
* Put the reference grabbed by send_mayday(). @pool might
* go away any time after it.
*/
put_pwq_unlocked(pwq);
raw_spin_lock_irq(&wq_mayday_lock);
}