linux-kernel - Re: [PATCH v3] workqueue: Fix double kfree for rescuer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9e7c20bd-8161-0790-36de-108c6dae65df@windriver.com>
Date:   Tue, 26 May 2020 10:04:49 +0000
From:   "Zhang, Qiang" <Qiang.Zhang@...driver.com>
To:     Lai Jiangshan <jiangshanlai@...il.com>
CC:     Tejun Heo <tj@...nel.org>,
        "markus.elfring@....de" <markus.elfring@....de>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v3] workqueue: Fix double kfree for rescuer

Thank you reply
There is something wrong with my description.  is it feasible to describe as follows:

The resucer is already free in "destroy_workqueue" and
    "wq->rescuer = NULL" was executed, but in "rcu_free_wq"
    it's release again (equivalent to kfree(NULL)), this is
    unnecessary, so should remove.


On 5/26/20 4:56 PM, Lai Jiangshan wrote:
> On Mon, May 25, 2020 at 5:22 PM <qiang.zhang@...driver.com> wrote:
>>
>> From: Zhang Qiang <qiang.zhang@...driver.com>
>>
>> The callback function "rcu_free_wq" could be called after memory
>> was released for "rescuer" already, Thus delete a misplaced call
>> of the function "kfree".
> 
> Hello
> 
> wq->rescuer is guaranteed to be NULL in rcu_free_wq()
> since def98c84b6cd
> ("workqueue: Fix spurious sanity check failures in destroy_workqueue()")
> 
> And the resucer is already free in destroy_workqueue()
> since 8efe1223d73c
> ("workqueue: Fix missing kfree(rescuer) in destroy_workqueue()")
> 
> The patch is a cleanup to remove a "kfree(NULL);".
> But the changelog is misleading.
> 
>>
>> Fixes: 6ba94429c8e7 ("workqueue: Reorder sysfs code")
> 
> It is totally unrelated.
> 
>> Signed-off-by: Zhang Qiang <qiang.zhang@...driver.com>
>> ---
>>   v1->v2->v3:
>>   Only commit information modification.
>>   kernel/workqueue.c | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
>> index 891ccad5f271..a2451cdcd503 100644
>> --- a/kernel/workqueue.c
>> +++ b/kernel/workqueue.c
>> @@ -3491,7 +3491,6 @@ static void rcu_free_wq(struct rcu_head *rcu)
>>          else
>>                  free_workqueue_attrs(wq->unbound_attrs);
>>
>> -       kfree(wq->rescuer);
>>          kfree(wq);
>>   }
>>
>> --
>> 2.24.1
>>