linux-kernel - [PATCH -next] workqueue: correct input of __alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20240820132650.361160-1-chenridong@huawei.com>
Date: Tue, 20 Aug 2024 13:26:50 +0000
From: Chen Ridong <chenridong@...wei.com>
To: <tj@...nel.org>, <jiangshanlai@...il.com>, <matthew.brost@...el.com>
CC: <linux-kernel@...r.kernel.org>
Subject: [PATCH -next] workqueue: correct input of __alloc_workqueue

When I boot on qemu, it failed like that:
 sysfs: cannot create duplicate filename '/devices/virtual/workqueue/scsi_tmf_80560'
 CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.11.0-rc1-00003-gb188c57af2b5-dirty #95
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
 Call Trace:
  <TASK>
  dump_stack_lvl+0x83/0xa0
  sysfs_warn_dup+0x5b/0x70
  sysfs_create_dir_ns+0xbe/0xd0
  kobject_add_internal+0x9e/0x270
  kobject_add+0x7e/0xf0
  ? get_device_parent+0x108/0x1d0
  device_add+0x113/0x810
  ? __init_waitqueue_head+0x4e/0x70
  workqueue_sysfs_register+0x8d/0x140
  __alloc_workqueue+0x6a0/0x800
  ? local_clock_noinstr+0x41/0xc0
  alloc_workqueue+0x53/0x100
  ? try_to_wake_up+0x25e/0x890
  scsi_host_alloc+0x3b6/0x4b0

This is also reported at [1].
The commit b188c57af2b5 ("workqueue: Split alloc_workqueue into internal
function and lockdep init") split internal __alloc_workqueue into function.
The variable inputs to __alloc_workqueue is incorrect, which leads to args
in __alloc_workqueue being indeterminate.
To fix this issue, change __alloc_workqueue‘s '...' to 'va_list args'.

[1] https://lore.kernel.org/all/202408161132.7c52d91a-oliver.sang@intel.com/

Fixes: b188c57af2b5 ("workqueue: Split alloc_workqueue into internal function and lockdep init")
Signed-off-by: Chen Ridong <chenridong@...wei.com>
---
 kernel/workqueue.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index bfeeefeee332..58b5d25dbf6f 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5623,12 +5623,10 @@ static void wq_adjust_max_active(struct workqueue_struct *wq)
 	} while (activated);
 }

-__printf(1, 4)
 static struct workqueue_struct *__alloc_workqueue(const char *fmt,
 						  unsigned int flags,
-						  int max_active, ...)
+						  int max_active, va_list args)
 {
-	va_list args;
 	struct workqueue_struct *wq;
 	size_t wq_size;
 	int name_len;
@@ -5660,9 +5658,7 @@ static struct workqueue_struct *__alloc_workqueue(const char *fmt,
 			goto err_free_wq;
 	}

-	va_start(args, max_active);
 	name_len = vsnprintf(wq->name, sizeof(wq->name), fmt, args);
-	va_end(args);

 	if (name_len >= WQ_NAME_LEN)
 		pr_warn_once("workqueue: name exceeds WQ_NAME_LEN. Truncating to: %s\n",
@@ -5718,7 +5714,6 @@ static struct workqueue_struct *__alloc_workqueue(const char *fmt,
 		goto err_unlock_destroy;

 	apply_wqattrs_unlock();
-
 	if ((wq->flags & WQ_SYSFS) && workqueue_sysfs_register(wq))
 		goto err_destroy;

-- 
2.34.1