Received-SPF: pass (google.com: domain of linux-kernel+bounces-206503-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
From: Tim Van Patten <timvp@chromium.org>
To: LKML <linux-kernel@vger.kernel.org>
Cc: druth@chromium.org,
	Tim Van Patten <timvp@google.com>,
	Lai Jiangshan <jiangshanlai@gmail.com>,
	Tejun Heo <tj@kernel.org>
Subject: [PATCH] workqueue: Prevent delayed work UAF kernel panic
Date: Fri,  7 Jun 2024 10:46:11 -0600
Message-ID: <20240607104610.1.I6c23f4fdb786f7200f6f1255af57b4e9621bcc66@changeid>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

From: Tim Van Patten <timvp@google.com>

A kernel panic can be triggered by delayed work being queued to a
workqueue that has been destroyed (wq->cpu_pwq nullified).

Commit 33e3f0a3358b ("workqueue: Add a new flag to spot the potential
UAF error")added the flag __WQ_DESTROYING to help avoid this. However,
this solution still allows work to be queued if it's from the same
workqueue, even if the workqueue has been fully destroyed, which is
possible with queue_delayed_work().

1. queue_delayed_work()
2. destroy_workqueue()
3. [delayed work timer expires]: delayed_work_timer_fn()

To prevent kernel panics, check if the pwq and pwq->pool pointers are
valid before derefencing them, and discard the work if they're not.

Discarding all work once __WQ_DESTROYING has been set (including from
the same workqueue) causes breakage, so we must check the pointers
directly.

Signed-off-by: Tim Van Patten <timvp@google.com>
---

 kernel/workqueue.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 003474c9a77d0..6bcd5605dbc8b 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2291,6 +2291,18 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
 	}
 
 	pwq = rcu_dereference(*per_cpu_ptr(wq->cpu_pwq, cpu));
+
+	/*
+	 * Discard work queued to a destroyed wq.
+	 * This must be checked while the rcu_read_lock() is
+	 * held, so destroy_workqueue() cannot nullify wq->cpu_pwq while it's
+	 * being accessed here.
+	 */
+	if (WARN_ON_ONCE(!pwq || !pwq->pool)) {
+		pr_warn("workqueue %s: discarding work for destroyed wq\n", wq->name);
+		goto out_rcu_read_unlock;
+	}
+
 	pool = pwq->pool;
 
 	/*
@@ -2365,6 +2377,7 @@ static void __queue_work(int cpu, struct workqueue_struct *wq,
 
 out:
 	raw_spin_unlock(&pool->lock);
+out_rcu_read_unlock:
 	rcu_read_unlock();
 }
 
-- 
2.45.2.505.gda0bf45e8d-goog