Re: [PATCH 08/10] workqueue: Introduce struct wq_node_nr_active

[Lai Jiangshan]

Hello, Tejun

On Fri, Jan 26, 2024 at 1:06 AM Tejun Heo <tj@xxxxxxxxxx> wrote:

> @@ -4036,12 +4097,62 @@ static void wq_free_lockdep(struct workqueue_struct *wq)
>  }
>  #endif
>
> +static void free_node_nr_active(struct wq_node_nr_active **nna_ar)
> +{
> +       int node;
> +
> +       for_each_node(node) {
> +               kfree(nna_ar[node]);
> +               nna_ar[node] = NULL;
> +       }
> +
> +       kfree(nna_ar[nr_node_ids]);
> +       nna_ar[nr_node_ids] = NULL;
> +}
> +

[....]


>  static void rcu_free_wq(struct rcu_head *rcu)
>  {
>         struct workqueue_struct *wq =
>                 container_of(rcu, struct workqueue_struct, rcu);
>
>         wq_free_lockdep(wq);
> +       free_node_nr_active(wq->node_nr_active);

for percpu workqueue, free_node_nr_active() will access out of bound.

>         free_percpu(wq->cpu_pwq);
>         free_workqueue_attrs(wq->unbound_attrs);
>         kfree(wq);

[......]

> @@ -4832,8 +4950,13 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
>         wq_init_lockdep(wq);
>         INIT_LIST_HEAD(&wq->list);
>
> +       if (flags & WQ_UNBOUND) {
> +               if (alloc_node_nr_active(wq->node_nr_active) < 0)
> +                       goto err_unreg_lockdep;
> +       }
> +
>         if (alloc_and_link_pwqs(wq) < 0)
> -               goto err_unreg_lockdep;
> +               goto err_free_node_nr_active;
>
>         if (wq_online && init_rescuer(wq) < 0)
>                 goto err_destroy;
> @@ -4858,6 +4981,8 @@ struct workqueue_struct *alloc_workqueue(const char *fmt,
>
>         return wq;
>
> +err_free_node_nr_active:
> +       free_node_nr_active(wq->node_nr_active);


for percpu workqueue, free_node_nr_active() will access out of bound.


Thanks
Lai

>  err_unreg_lockdep:
>         wq_unregister_lockdep(wq);
>         wq_free_lockdep(wq);
> --
> 2.43.0
>