ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-23 20:51:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

workqueue: Add a new flag to spot the potential UAF error

Browse Source 
Currently if the user queues a new work item unintentionally
into a wq after the destroy_workqueue(wq), the work still can
be queued and scheduled without any noticeable kernel message
before the end of a RCU grace period.

As a debug-aid facility, this commit adds a new flag
__WQ_DESTROYING to spot that issue by triggering a kernel WARN
message.

Signed-off-by: Richard Clark <richard.xnu.clark@gmail.com>
Reviewed-by: Lai Jiangshan <jiangshanlai@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
This commit is contained in:
Richard Clark
2022-12-13 12:39:36 +08:00
committed by Tejun Heo
parent 512dee0c00
commit 33e3f0a335
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/workqueue.h
View File

@@ -335,6 +335,7 @@ enum {
*/ */
WQ_POWER_EFFICIENT = 1 << 7, WQ_POWER_EFFICIENT = 1 << 7,
__WQ_DESTROYING = 1 << 15, /* internal: workqueue is destroying */
__WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */ __WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */
__WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */ __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */
__WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */ __WQ_LEGACY = 1 << 18, /* internal: create*_workqueue() */

15
kernel/workqueue.c
View File

@@ -1433,9 +1433,13 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
lockdep_assert_irqs_disabled(); lockdep_assert_irqs_disabled();
/* if draining, only works from the same workqueue are allowed */ /*
if (unlikely(wq->flags & __WQ_DRAINING) && * For a draining wq, only works from the same workqueue are
WARN_ON_ONCE(!is_chained_work(wq))) * allowed. The __WQ_DESTROYING helps to spot the issue that
* queues a new work item to a wq after destroy_workqueue(wq).
*/
if (unlikely(wq->flags & (__WQ_DESTROYING | __WQ_DRAINING) &&
WARN_ON_ONCE(!is_chained_work(wq))))
return; return;
rcu_read_lock(); rcu_read_lock();
retry: retry:
@@ -4414,6 +4418,11 @@ void destroy_workqueue(struct workqueue_struct *wq)
*/ */
workqueue_sysfs_unregister(wq); workqueue_sysfs_unregister(wq);
/* mark the workqueue destruction is in progress */
mutex_lock(&wq->mutex);
wq->flags |= __WQ_DESTROYING;
mutex_unlock(&wq->mutex);
/* drain it before proceeding with destruction */ /* drain it before proceeding with destruction */
drain_workqueue(wq); drain_workqueue(wq);