linux-kernel - [PATCH][RFC] workqueue: Fix kernel panic on CPU hot-unplug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZbqfMR_mVLaSCj4Q@carbonx1>
Date: Wed, 31 Jan 2024 20:27:45 +0100
From: Helge Deller <deller@...nel.org>
To: Tejun Heo <tj@...nel.org>, Lai Jiangshan <jiangshanlai@...il.com>,
	linux-kernel@...r.kernel.org
Cc: linux-parisc@...r.kernel.org
Subject: [PATCH][RFC] workqueue: Fix kernel panic on CPU hot-unplug

When hot-unplugging a 32-bit CPU on the parisc platform with
"chcpu -d 1", I get the following kernel panic. Adding a check
for !pwq prevents the panic.

 Kernel Fault: Code=26 (Data memory access rights trap) at addr 00000000
 CPU: 1 PID: 21 Comm: cpuhp/1 Not tainted 6.8.0-rc1-32bit+ #1291
 Hardware name: 9000/778/B160L
 
 IASQ: 00000000 00000000 IAOQ: 10446db4 10446db8
  IIR: 0f80109c    ISR: 00000000  IOR: 00000000
  CPU:        1   CR30: 11dd1710 CR31: 00000000
  IAOQ[0]: wq_update_pod+0x98/0x14c
  IAOQ[1]: wq_update_pod+0x9c/0x14c
  RP(r2): wq_update_pod+0x80/0x14c
 Backtrace:
  [<10448744>] workqueue_offline_cpu+0x1d4/0x1dc
  [<10429db4>] cpuhp_invoke_callback+0xf8/0x200
  [<1042a1d0>] cpuhp_thread_fun+0xb8/0x164
  [<10452970>] smpboot_thread_fn+0x284/0x288
  [<1044d8f4>] kthread+0x12c/0x13c
  [<1040201c>] ret_from_kernel_thread+0x1c/0x24
 Kernel panic - not syncing: Kernel Fault

Signed-off-by: Helge Deller <deller@....de>

---

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 76e60faed892..dfeee7b7322c 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4521,6 +4521,8 @@ static void wq_update_pod(struct workqueue_struct *wq, int cpu,
 	wq_calc_pod_cpumask(target_attrs, cpu, off_cpu);
 	pwq = rcu_dereference_protected(*per_cpu_ptr(wq->cpu_pwq, cpu),
 					lockdep_is_held(&wq_pool_mutex));
+	if (!pwq)
+		return;
 	if (wqattrs_equal(target_attrs, pwq->pool->attrs))
 		return;