Pull workqueue fix from Tejun Heo: - Fix a regression where a worker pool can be freed before rescuer workers are done with it leading to user-after-free * tag 'wq-for-6.14-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Put the pwq after detaching the rescuer from the pool
Showing the changes to kernel/workqueue.c (1 of 1 file). Show all
Unified · Split
| @@ -3516,12 +3516,6 @@ repeat: · 3515 unmodified lines | ||
| 3516 | 3516 | } |
| 3517 | 3517 | } |
| 3518 | 3518 | |
| 3519 | − /* | |
| 3520 | − * Put the reference grabbed by send_mayday(). @pool won't | |
| 3521 | − * go away while we're still attached to it. | |
| 3522 | − */ | |
| 3523 | − put_pwq(pwq); | |
| 3524 | − | |
| 3525 | 3519 | /* |
| 3526 | 3520 | * Leave this pool. Notify regular workers; otherwise, we end up |
| 3527 | 3521 | * with 0 concurrency and stalling the execution. |
| @@ -3532,6 +3526,12 @@ repeat: · 4 unmodified lines | ||
| 3532 | 3526 | |
| 3533 | 3527 | worker_detach_from_pool(rescuer); |
| 3534 | 3528 | |
| 3529 | + /* | |
| 3530 | + * Put the reference grabbed by send_mayday(). @pool might | |
| 3531 | + * go away any time after it. | |
| 3532 | + */ | |
| 3533 | + put_pwq_unlocked(pwq); | |
| 3534 | + | |
| 3535 | 3535 | raw_spin_lock_irq(&wq_mayday_lock); |
| 3536 | 3536 | } |
| 3537 | 3537 | |