linux-kernel - Re: [PATCH] workqueue: rust: add creation of workqueues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z_45kDv_wAHIBNpI@cassiopeiae>
Date: Tue, 15 Apr 2025 12:48:48 +0200
From: Danilo Krummrich <dakr@...nel.org>
To: Alice Ryhl <aliceryhl@...gle.com>
Cc: Tejun Heo <tj@...nel.org>, Miguel Ojeda <ojeda@...nel.org>,
	Lai Jiangshan <jiangshanlai@...il.com>,
	Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>,
	Björn Roy Baron <bjorn3_gh@...tonmail.com>,
	Benno Lossin <benno.lossin@...ton.me>,
	Andreas Hindborg <a.hindborg@...nel.org>,
	Trevor Gross <tmgross@...ch.edu>,
	Daniel Almeida <daniel.almeida@...labora.com>,
	Tamir Duberstein <tamird@...il.com>, rust-for-linux@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] workqueue: rust: add creation of workqueues

On Tue, Apr 15, 2025 at 09:01:35AM +0000, Alice Ryhl wrote:
> On Mon, Apr 14, 2025 at 08:15:41PM +0200, Danilo Krummrich wrote:
> > On Fri, Apr 11, 2025 at 03:34:24PM +0000, Alice Ryhl wrote:
> > > 
> > > +/// An owned kernel work queue.
> > 
> > I'd suggest to document that dropping an OwnedQueue will wait for pending work.
> > 
> > Additionally, given that you're about to implement delayed work as well, we
> > should also mention that destroy_workqueue() currently does not cover waiting
> > for delayed work *before* it is scheduled and hence may cause WARN() splats or
> > even UAF bugs.
> 
> Ah, that's a problem :(
> 
> Can we make destroy_workqueue() wait for delayed items too? And/or have
> a variant of it that does so? I'm not sure what is best to do here...

I think the problem is that the workq is not aware of all the timers in flight
and simply queues the work in the timer callback. See also [1].

I'm not sure there's an easy solution to that, without adding extra overhead,
such as keeping a list of timers in flight in the workqueue end. :(

[1] https://elixir.bootlin.com/linux/v6.13.7/source/kernel/workqueue.c#L2489