2020-05-25 16:56:17

by Zhang, Qiang

Subject: [PATCH] workqueue: Fix double kfree for rescuer

From: Zhang Qiang <[email protected]>

The duplicate memory release should be deleted from the implementation
of the callback function "rcu_free_wq".

Fixes: 6ba94429c8e7 ("workqueue: Reorder sysfs code")
Signed-off-by: Zhang Qiang <[email protected]>
---
kernel/workqueue.c | 1 -
1 file changed, 1 deletion(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 891ccad5f271..a2451cdcd503 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3491,7 +3491,6 @@ static void rcu_free_wq(struct rcu_head *rcu)
else
free_workqueue_attrs(wq->unbound_attrs);

- kfree(wq->rescuer);
kfree(wq);
}

--
2.24.1

2020-05-25 17:43:21

by Markus Elfring

Subject: Re: [PATCH v2] workqueue: Fix double kfree for rescuer

> The duplicate memory release should be deleted from the implementation
> of the callback function "rcu_free_wq".

I tried to help with the selection of a better commit message.
I have taken another look also at the implementation of the function “destroy_workqueue”.

* The function call “destroy_workqueue” can be performed there in an if branch
after the statement “wq->rescuer = NULL” was executed.

* This data processing is independent from a possible call of the
function “call_rcu(&wq->rcu, rcu_free_wq)” in another if branch.
Thus it seems that a null pointer is intentionally passed by a data structure
member to this callback function on demand.
The corresponding call of the function “kfree” can tolerate this special case.


Now I find that the proposed change can be inappropriate.

Regards,
Markus