Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) client-ip=2620:137:e000::3:6;
Sender: Tejun Heo <htejun@gmail.com>
Date:   Wed, 4 Oct 2023 09:15:41 -1000
From:   Tejun Heo <tj@kernel.org>
To:     Zqiang <qiang.zhang1211@gmail.com>
Cc:     jiangshanlai@gmail.com, syzkaller-bugs@googlegroups.com,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH v3] workqueue: Fix UAF report by KASAN in
 pwq_release_workfn()
Message-ID: <ZR253RO-apOz0DUg@slm.duckdns.org>
References: <20230920060704.24981-1-qiang.zhang1211@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230920060704.24981-1-qiang.zhang1211@gmail.com>
Precedence: bulk

On Wed, Sep 20, 2023 at 02:07:04PM +0800, Zqiang wrote:
> Currently, for UNBOUND wq, if the apply_wqattrs_prepare() return error,
> the apply_wqattr_cleanup() will be called and use the pwq_release_worker
> kthread to release resources asynchronously. however, the kfree(wq) is
> invoked directly in failure path of alloc_workqueue(), if the kfree(wq)
> has been executed and when the pwq_release_workfn() accesses wq, this
> leads to the following scenario:

Applied to cgroup/for-6.6-fixes.

Thanks.

-- 
tejun