linux-kernel - RE: [PATCH] workqueue: fix a workqueue kernel panic issue.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4737A960563B524DA805CA602BE04B307EEE6C2694@SC-VEXCH2.marvell.com>
Date:	Sun, 21 Sep 2014 20:30:32 -0700
From:	Yifan Zhang <zhangyf@...vell.com>
To:	Yifan Zhang <zhangyf@...vell.com>, Tejun Heo <tj@...nel.org>,
	Jing Xiang <jxiang@...vell.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH] workqueue: fix a workqueue kernel panic issue.

Hi Tejun,

What's do you think of this patch ? Any concern ?

BR,
Yifan

-----Original Message-----
From: Yifan Zhang [mailto:zhangyf@...vell.com] 
Sent: 2014年9月17日 16:18
To: Tejun Heo; Jing Xiang; linux-kernel@...r.kernel.org
Cc: Yifan Zhang
Subject: [PATCH] workqueue: fix a workqueue kernel panic issue.

if created workqueue in multi-thread unsynchronized,
get_work_pwq() may return NULL, which cause kernel panic. Judge get_work_pwq() return value before use
pwq->wq->flags.

Signed-off-by: Yifan Zhang <zhangyf@...vell.com>
---
 kernel/workqueue.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 5dbe22a..d3ac87f 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1947,9 +1947,19 @@ __acquires(&pool->lock)  {
 	struct pool_workqueue *pwq = get_work_pwq(work);
 	struct worker_pool *pool = worker->pool;
-	bool cpu_intensive = pwq->wq->flags & WQ_CPU_INTENSIVE;
+	bool cpu_intensive;
 	int work_color;
 	struct worker *collision;
+
+	if (pwq == NULL) {
+		pr_err("BUG: invalid struct work_struct.data %lu\n",
+				atomic_long_read(&work->data));
+		dump_stack();
+		return;
+	}
+
+	cpu_intensive = pwq->wq->flags & WQ_CPU_INTENSIVE;
+
 #ifdef CONFIG_LOCKDEP
 	/*
 	 * It is permissible to free the struct work_struct from
--
1.7.9.5