2014-04-14 23:17:50

by Daeseok Youn

[permalink] [raw]
Subject: [PATCH V3] workqueue: fix double unlock bug


Use default pwq when alloc_unbound_pwq() is failed.

And remove "if" condition for whether "pwq" is same as "wq->dfl_pwq"
when wq_calc_node_cpumask() returns false and just use "goto use_dfl_pwq"

Signed-off-by: Daeseok Youn <[email protected]>
---
V2: replace "if condition" with "goto" as Lai's comment.
V3: Use default pwq when alloc_unbound_pwq() is failed.

kernel/workqueue.c | 8 +++-----
1 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 0ee63af..0679854 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -4087,10 +4087,7 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
if (cpumask_equal(cpumask, pwq->pool->attrs->cpumask))
goto out_unlock;
} else {
- if (pwq == wq->dfl_pwq)
- goto out_unlock;
- else
- goto use_dfl_pwq;
+ goto use_dfl_pwq;
}

mutex_unlock(&wq->mutex);
@@ -4100,7 +4097,8 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
if (!pwq) {
pr_warning("workqueue: allocation failed while updating NUMA affinity of \"%s\"\n",
wq->name);
- goto out_unlock;
+ mutex_lock(&wq->mutex);
+ goto use_dfl_pwq;
}

/*
--
1.7.4.4


2014-04-15 03:29:27

by Lai Jiangshan

[permalink] [raw]
Subject: Re: [PATCH V3] workqueue: fix double unlock bug

Hi, Tejun

Acked-by: Lai Jiangshan <[email protected]>
CC: [email protected]

Thanks,
Lai

On 04/15/2014 07:17 AM, Daeseok Youn wrote:
>
> Use default pwq when alloc_unbound_pwq() is failed.
>
> And remove "if" condition for whether "pwq" is same as "wq->dfl_pwq"
> when wq_calc_node_cpumask() returns false and just use "goto use_dfl_pwq"
>
> Signed-off-by: Daeseok Youn <[email protected]>
> ---
> V2: replace "if condition" with "goto" as Lai's comment.
> V3: Use default pwq when alloc_unbound_pwq() is failed.
>
> kernel/workqueue.c | 8 +++-----
> 1 files changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> index 0ee63af..0679854 100644
> --- a/kernel/workqueue.c
> +++ b/kernel/workqueue.c
> @@ -4087,10 +4087,7 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
> if (cpumask_equal(cpumask, pwq->pool->attrs->cpumask))
> goto out_unlock;
> } else {
> - if (pwq == wq->dfl_pwq)
> - goto out_unlock;
> - else
> - goto use_dfl_pwq;
> + goto use_dfl_pwq;
> }
>
> mutex_unlock(&wq->mutex);
> @@ -4100,7 +4097,8 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
> if (!pwq) {
> pr_warning("workqueue: allocation failed while updating NUMA affinity of \"%s\"\n",
> wq->name);
> - goto out_unlock;
> + mutex_lock(&wq->mutex);
> + goto use_dfl_pwq;
> }
>
> /*

2014-04-15 14:43:30

by Tejun Heo

[permalink] [raw]
Subject: Re: [PATCH V3] workqueue: fix double unlock bug

On Tue, Apr 15, 2014 at 08:17:43AM +0900, Daeseok Youn wrote:
>
> Use default pwq when alloc_unbound_pwq() is failed.
>
> And remove "if" condition for whether "pwq" is same as "wq->dfl_pwq"
> when wq_calc_node_cpumask() returns false and just use "goto use_dfl_pwq"
>
> Signed-off-by: Daeseok Youn <[email protected]>

This is an awfully inadequate patch description. Can you change it to
something like the following?

workqueue: fix bugs in wq_update_unbound_numa() failure path

wq_update_unbound_numa() failure path has the following two bugs.

* alloc_unbound_pwq() is called without holding wq->mutex; however, if
the allocation fails, it jumps to out_unlock which tries to unlock
wq->mutex.

* The function should switch to dfl_pwq on failure but didn't do so
after alloc_unbound_pwq() failure.

Fix it by regrabbing wq->mutex and jumping to use_dfl_pwq on
alloc_unbound_pwq() failure.


> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> index 0ee63af..0679854 100644
> --- a/kernel/workqueue.c
> +++ b/kernel/workqueue.c
> @@ -4087,10 +4087,7 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
> if (cpumask_equal(cpumask, pwq->pool->attrs->cpumask))
> goto out_unlock;
> } else {
> - if (pwq == wq->dfl_pwq)
> - goto out_unlock;
> - else
> - goto use_dfl_pwq;
> + goto use_dfl_pwq;

And please put this in a separate patch. Patches which are to be
backported through -stable should be minimal. Also, please update the
comment above to reflect the change.

Thanks.

--
tejun

2014-04-15 23:01:30

by Daeseok Youn

[permalink] [raw]
Subject: Re: [PATCH V3] workqueue: fix double unlock bug

Hi, Tejun.

2014-04-15 23:43 GMT+09:00 Tejun Heo <[email protected]>:
> On Tue, Apr 15, 2014 at 08:17:43AM +0900, Daeseok Youn wrote:
>>
>> Use default pwq when alloc_unbound_pwq() is failed.
>>
>> And remove "if" condition for whether "pwq" is same as "wq->dfl_pwq"
>> when wq_calc_node_cpumask() returns false and just use "goto use_dfl_pwq"
>>
>> Signed-off-by: Daeseok Youn <[email protected]>
>
> This is an awfully inadequate patch description. Can you change it to
> something like the following?
OK. I will change the patch description as your comment.

>
> workqueue: fix bugs in wq_update_unbound_numa() failure path
>
> wq_update_unbound_numa() failure path has the following two bugs.
>
> * alloc_unbound_pwq() is called without holding wq->mutex; however, if
> the allocation fails, it jumps to out_unlock which tries to unlock
> wq->mutex.
>
> * The function should switch to dfl_pwq on failure but didn't do so
> after alloc_unbound_pwq() failure.
>
> Fix it by regrabbing wq->mutex and jumping to use_dfl_pwq on
> alloc_unbound_pwq() failure.
>
>
>> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
>> index 0ee63af..0679854 100644
>> --- a/kernel/workqueue.c
>> +++ b/kernel/workqueue.c
>> @@ -4087,10 +4087,7 @@ static void wq_update_unbound_numa(struct workqueue_struct *wq, int cpu,
>> if (cpumask_equal(cpumask, pwq->pool->attrs->cpumask))
>> goto out_unlock;
>> } else {
>> - if (pwq == wq->dfl_pwq)
>> - goto out_unlock;
>> - else
>> - goto use_dfl_pwq;
>> + goto use_dfl_pwq;
>
> And please put this in a separate patch. Patches which are to be
> backported through -stable should be minimal. Also, please update the
> comment above to reflect the change.
Yes, I will do.

Thanks for review.

Regards,
Daeseok Youn.
>
> Thanks.
>
> --
> tejun