History

workqueue: Fix an use after free in init_rescuer()

We need to preserve error code before freeing "rescuer".

Dan Carpenter committed 6 years ago

Commit b92b36e1 parent f187b691 file · +3 −1Browse files

Showing the changes to kernel/workqueue.c (1 of 1 file). Show all

Unified · Split

kernel/workqueue.c+3−1
@@ -4197,6 +4197,7 @@ static int wq_clamp_max_active(int max_active, unsigned int flags, · 4196 unmodified lines
4197static int init_rescuer(struct workqueue_struct *wq)4197static int init_rescuer(struct workqueue_struct *wq)
4198{4198{
4199 struct worker *rescuer;4199 struct worker *rescuer;
4200 int ret;
4200 4201
4201 if (!(wq->flags & WQ_MEM_RECLAIM))4202 if (!(wq->flags & WQ_MEM_RECLAIM))
4202 return 0;4203 return 0;
@@ -4208,8 +4209,9 @@ static int init_rescuer(struct workqueue_struct *wq) · 5 unmodified lines
4208 rescuer->rescue_wq = wq;4209 rescuer->rescue_wq = wq;
4209 rescuer->task = kthread_create(rescuer_thread, rescuer, "%s", wq->name);4210 rescuer->task = kthread_create(rescuer_thread, rescuer, "%s", wq->name);
4210 if (IS_ERR(rescuer->task)) {4211 if (IS_ERR(rescuer->task)) {
4212 ret = PTR_ERR(rescuer->task);
4211 kfree(rescuer);4213 kfree(rescuer);
4212 return PTR_ERR(rescuer->task);4214 return ret;
4213 }4215 }
4214 4216
4215 wq->rescuer = rescuer;4217 wq->rescuer = rescuer;