Re: [PATCH] workqueue: Put the pwq after detaching the rescuer from the pool

[Tejun Heo]

On Thu, Jan 23, 2025 at 04:25:35PM +0800, Lai Jiangshan wrote:
> From: Lai Jiangshan <jiangshan.ljs@xxxxxxxxxxxx>
> 
> The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and
> remove detach_completion") adds code to reap the normal workers but
> mistakenly does not handle the rescuer and also removes the code waiting
> for the rescuer in put_unbound_pool(), which caused a use-after-free bug
> reported by Cheung Wall.
> 
> To avoid the use-after-free bug, the pool’s reference must be held until
> the detachment is complete. Therefore, move the code that puts the pwq
> after detaching the rescuer from the pool.
> 
> Reported-by: cheung wall <zzqq0103.hey@xxxxxxxxx>
> Cc: cheung wall <zzqq0103.hey@xxxxxxxxx>
> Link: https://lore.kernel.org/lkml/CAKHoSAvP3iQW+GwmKzWjEAOoPvzeWeoMO0Gz7Pp3_4kxt-RMoA@xxxxxxxxxxxxxx/
> Fixes: 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion")
> Signed-off-by: Lai Jiangshan <jiangshan.ljs@xxxxxxxxxxxx>

Applied to wq/for-6.14-fixes.

Thanks.

-- 
tejun