Pull workqueue fix from Tejun Heo: - Fix a regression where a worker pool can be freed before rescuer workers are done with it leading to user-after-free * tag 'wq-for-6.14-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Put the pwq after detaching the rescuer from the pool
Showing the changes to kernel/workqueue.c (1 of 1 file). Show all
Unified · Split
| @@ -3516,12 +3516,6 @@ repeat: · 3515 unmodified lines | |||
| 3516 | } | 3516 | } |
| 3517 | } | 3517 | } |
| 3518 | 3518 | ||
| 3519 | /* | ||
| 3520 | * Put the reference grabbed by send_mayday(). @pool won't | ||
| 3521 | * go away while we're still attached to it. | ||
| 3522 | */ | ||
| 3523 | put_pwq(pwq); | ||
| 3524 | |||
| 3525 | /* | 3519 | /* |
| 3526 | * Leave this pool. Notify regular workers; otherwise, we end up | 3520 | * Leave this pool. Notify regular workers; otherwise, we end up |
| 3527 | * with 0 concurrency and stalling the execution. | 3521 | * with 0 concurrency and stalling the execution. |
| @@ -3532,6 +3526,12 @@ repeat: · 4 unmodified lines | |||
| 3532 | 3526 | ||
| 3533 | worker_detach_from_pool(rescuer); | 3527 | worker_detach_from_pool(rescuer); |
| 3534 | 3528 | ||
| 3529 | /* | ||
| 3530 | * Put the reference grabbed by send_mayday(). @pool might | ||
| 3531 | * go away any time after it. | ||
| 3532 | */ | ||
| 3533 | put_pwq_unlocked(pwq); | ||
| 3534 | |||
| 3535 | raw_spin_lock_irq(&wq_mayday_lock); | 3535 | raw_spin_lock_irq(&wq_mayday_lock); |
| 3536 | } | 3536 | } |
| 3537 | 3537 | ||