Messages in this thread Patch in this message | | | Subject | Re: [PATCH] workqueue: Try to catch flush work() wi thout INIT WORK(). | From | Tetsuo Handa <> | Date | Wed, 23 Jan 2019 09:44:12 +0900 |
| |
Daniel Jordan wrote: > On Sat, Jan 19, 2019 at 11:41:22AM +0900, Tetsuo Handa wrote: > > On 2019/01/19 4:48, Daniel Jordan wrote: > > > On Sat, Jan 19, 2019 at 02:04:58AM +0900, Tetsuo Handa wrote: > > > __queue_work has a sanity check already for work, but using list_empty. Seems > > > slightly better to be consistent? > > > > > > > list_empty() won't work, for "struct work_struct" is embedded into a struct > > which is allocated by kzalloc(). > > Please check list_empty's definition again, it compares the address of the node > to its next pointer, so it should work for a zeroed node. I'll reiterate that > it seems slightly better to be consistent in "is work_struct initialized?" > checks, but it's not a big deal and I'm fine either way.
You are talking about
if (WARN_ON(!list_empty(&work->entry))) { spin_unlock(&pwq->pool->lock); return; }
part in __queue_work(), aren't you? But since flush_work() is used for waiting for a work to complete, that work can be either queued state (list_empty() == false) or not queued state (list_empty() == true). Thus, I don't think that flush_work() can use list_empty() for checking whether that work was initialized.
[PATCH v2] workqueue: Try to catch flush_work() without INIT_WORK().
syzbot found a flush_work() caller who forgot to call INIT_WORK() because that work_struct was allocated by kzalloc() [1]. But the message
INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator.
by lock_map_acquire() is failing to tell that INIT_WORK() is missing.
Since flush_work() without INIT_WORK() is a bug, and INIT_WORK() should set ->func field to non-zero, let's warn if ->func field is zero.
[1] https://syzkaller.appspot.com/bug?id=a5954455fcfa51c29ca2ab55b203076337e1c770
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> --- kernel/workqueue.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 392be4b..a503ad9 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -2908,6 +2908,9 @@ static bool __flush_work(struct work_struct *work, bool from_cancel) if (WARN_ON(!wq_online)) return false; + if (WARN_ON(!work->func)) + return false; + if (!from_cancel) { lock_map_acquire(&work->lockdep_map); lock_map_release(&work->lockdep_map);
| |