This is a note to let you know that I've just added the patch titled
workqueue: fix a possible race condition between rescuer and pwq-release
to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
workqueue-fix-a-possible-race-condition-between-rescuer-and-pwq-release.patch
and it can be found in the queue-3.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 77668c8b559e4fe2acf2a0749c7c83cde49a5025 Mon Sep 17 00:00:00 2001
From: Lai Jiangshan <[email protected]>
Date: Fri, 18 Apr 2014 11:04:16 -0400
Subject: workqueue: fix a possible race condition between rescuer and
pwq-release
From: Lai Jiangshan <[email protected]>
commit 77668c8b559e4fe2acf2a0749c7c83cde49a5025 upstream.
There is a race condition between rescuer_thread() and
pwq_unbound_release_workfn().
Even after a pwq is scheduled for rescue, the associated work items
may be consumed by any worker. If all of them are consumed before the
rescuer gets to them and the pwq's base ref was put due to attribute
change, the pwq may be released while still being linked on
@wq->maydays list making the rescuer dereference already freed pwq
later.
Make send_mayday() pin the target pwq until the rescuer is done with
it.
tj: Updated comment and patch description.
Signed-off-by: Lai Jiangshan <[email protected]>
Signed-off-by: Tejun Heo <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
kernel/workqueue.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1909,6 +1909,12 @@ static void send_mayday(struct work_stru
/* mayday mayday mayday */
if (list_empty(&pwq->mayday_node)) {
+ /*
+ * If @pwq is for an unbound wq, its base ref may be put at
+ * any time due to an attribute change. Pin @pwq until the
+ * rescuer is done with it.
+ */
+ get_pwq(pwq);
list_add_tail(&pwq->mayday_node, &wq->maydays);
wake_up_process(wq->rescuer->task);
}
@@ -2438,6 +2444,12 @@ repeat:
process_scheduled_works(rescuer);
/*
+ * Put the reference grabbed by send_mayday(). @pool won't
+ * go away while we're holding its lock.
+ */
+ put_pwq(pwq);
+
+ /*
* Leave this pool. If keep_working() is %true, notify a
* regular worker; otherwise, we end up with 0 concurrency
* and stalling the execution.
Patches currently in stable-queue which might be from [email protected] are
queue-3.14/futex-add-another-early-deadlock-detection-check.patch
queue-3.14/futex-prevent-attaching-to-kernel-threads.patch
queue-3.14/workqueue-make-rescuer_thread-empty-wq-maydays-list-before-exiting.patch
queue-3.14/rtmutex-fix-deadlock-detector-for-real.patch
queue-3.14/workqueue-fix-bugs-in-wq_update_unbound_numa-failure-path.patch
queue-3.14/workqueue-fix-a-possible-race-condition-between-rescuer-and-pwq-release.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
