[PATCH] workqueue: Fix NULL current_pwq deref in chained work check

[Pavankumar Kondeti]

current_wq_worker() only tells us that %current is a kworker. It does
not guarantee that the worker is currently executing a work item, as
worker->current_pwq is populated only while process_one_work() is running
the work function.

is_chained_work() can be reached while queueing on a draining or
destroying workqueue. If a kworker outside work-item execution reaches
that path, current_wq_worker() returns a worker but worker->current_pwq is
NULL, and the chained-work test can fault before it emits the intended
warning.

Guard the chained-work test with worker->current_pwq. A kworker without
current_pwq is not executing work on the target workqueue, so the helper
should return false and let the draining/destroying warning fire.

Fixes: c8efcc258946 ("workqueue: allow chained queueing during destruction")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Pavankumar Kondeti <pavan.kondeti@xxxxxxxxxxxxxxxx>
---
 kernel/workqueue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 959525393739..c56c042d1c35 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2290,7 +2290,7 @@ static bool is_chained_work(struct workqueue_struct *wq)
 	 * Return %true iff I'm a worker executing a work item on @wq.  If
 	 * I'm @worker, it's safe to dereference it without locking.
 	 */
-	return worker && worker->current_pwq->wq == wq;
+	return worker && worker->current_pwq && worker->current_pwq->wq == wq;
 }
 
 /*

---
base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
change-id: 20260928-wq_chain_fix-9f3814625b1a

Best regards,
-- 
Pavankumar Kondeti <pavan.kondeti@xxxxxxxxxxxxxxxx>