History

workqueue: Fix an use after free in init_rescuer()

We need to preserve error code before freeing "rescuer".

Dan Carpenter committed 6 years ago

Commit b92b36e1 parent f187b691 file · +3 −1Browse files

Showing the changes to kernel/workqueue.c (1 of 1 file). Show all

Unified · Split

kernel/workqueue.c+3−1
@@ -4197,6 +4197,7 @@ static int wq_clamp_max_active(int max_active, unsigned int flags, · 4196 unmodified lines
41974197 static int init_rescuer(struct workqueue_struct *wq)
41984198 {
41994199 struct worker *rescuer;
4200+ int ret;
42004201
42014202 if (!(wq->flags & WQ_MEM_RECLAIM))
42024203 return 0;
@@ -4208,8 +4209,9 @@ static int init_rescuer(struct workqueue_struct *wq) · 5 unmodified lines
42084209 rescuer->rescue_wq = wq;
42094210 rescuer->task = kthread_create(rescuer_thread, rescuer, "%s", wq->name);
42104211 if (IS_ERR(rescuer->task)) {
4212+ ret = PTR_ERR(rescuer->task);
42114213 kfree(rescuer);
4212− return PTR_ERR(rescuer->task);
4214+ return ret;
42134215 }
42144216
42154217 wq->rescuer = rescuer;