linux-kernel - Re: [PATCH 08/10] workqueue: Introduce struct wq_node_nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 30 Jan 2024 00:02:42 +0800
From: Lai Jiangshan <jiangshanlai@...il.com>
To: Tejun Heo <tj@...nel.org>
Cc: linux-kernel@...r.kernel.org, Naohiro.Aota@....com, kernel-team@...a.com
Subject: Re: [PATCH 08/10] workqueue: Introduce struct wq_node_nr_active

Hello, Tejun

On Fri, Jan 26, 2024 at 1:06 AM Tejun Heo <tj@...nel.org> wrote:

> @@ -4036,12 +4097,62 @@ static void wq_free_lockdep(struct workqueue_struct *wq)
>  }
>  #endif
>
> +static void free_node_nr_active(struct wq_node_nr_active **nna_ar)
> +{
> +       int node;
> +
> +       for_each_node(node) {
> +               kfree(nna_ar[node]);
> +               nna_ar[node] = NULL;
> +       }
> +
> +       kfree(nna_ar[nr_node_ids]);
> +       nna_ar[nr_node_ids] = NULL;
> +}
> +

[....]


>  static void rcu_free_wq(struct rcu_head *rcu)
>  {
>         struct workqueue_struct *wq =
>                 container_of(rcu, struct workqueue_struct, rcu);
>
>         wq_free_lockdep(wq);
> +       free_node_nr_active(wq->node_nr_active);

for percpu workqueue, free_node_nr_active() will access out of bound.

>         free_percpu(wq->cpu_pwq);
>         free_workqueue_attrs(wq->unbound_attrs);
>         kfree(wq);

[......]

> @@ -4832,8 +4950,13 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
>         wq_init_lockdep(wq);
>         INIT_LIST_HEAD(&wq->list);
>
> +       if (flags & WQ_UNBOUND) {
> +               if (alloc_node_nr_active(wq->node_nr_active) < 0)
> +                       goto err_unreg_lockdep;
> +       }
> +
>         if (alloc_and_link_pwqs(wq) < 0)
> -               goto err_unreg_lockdep;
> +               goto err_free_node_nr_active;
>
>         if (wq_online && init_rescuer(wq) < 0)
>                 goto err_destroy;
> @@ -4858,6 +4981,8 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
>
>         return wq;
>
> +err_free_node_nr_active:
> +       free_node_nr_active(wq->node_nr_active);


for percpu workqueue, free_node_nr_active() will access out of bound.


Thanks
Lai

>  err_unreg_lockdep:
>         wq_unregister_lockdep(wq);
>         wq_free_lockdep(wq);
> --
> 2.43.0
>