Messages in this thread | | | Subject | Re: [PATCH] workqueue: unregister wq lockdep on error path in alloc_workqueue() | From | Bart Van Assche <> | Date | Fri, 8 Mar 2019 06:45:26 -0800 |
| |
On 3/7/19 11:37 PM, Kefeng Wang wrote: > syzkaller report an issue "KASAN: use-after-free Read in alloc_workqueue", > > alloc_workqueue > - kzalloc wq > - wq_init_lockdep(wq); > - lockdep_register_key(&wq->key); // add to hlist > - kfree wq > > But forget to call wq_unregister_lockdep()->lockdep_unregister_key(), it > will delete the entry from hlist. > > Reported-by: syzbot+17335689e239ce135d8b@syzkaller.appspotmail.com > Fixes: 669de8bda87b ("kernel/workqueue: Use dynamic lockdep keys for workqueues") > Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> > --- > kernel/workqueue.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/kernel/workqueue.c b/kernel/workqueue.c > index 7abbeed13421..9209d25dfade 100644 > --- a/kernel/workqueue.c > +++ b/kernel/workqueue.c > @@ -4291,6 +4291,7 @@ struct workqueue_struct *alloc_workqueue(const char *fmt, > return wq; > > err_free_wq: > + wq_unregister_lockdep(wq); > free_workqueue_attrs(wq->unbound_attrs); > kfree(wq); > return NULL;
Hi Kefeng,
Five days ago I had posted a similar but slightly different patch. Can you have a look at it? See also https://lore.kernel.org/lkml/20190303220046.29448-1-bvanassche@acm.org/
Thanks,
Bart.
| |