[PATCH] ACPI: APEI: check return value of task_work_add to prevent memory leaks

[Wupeng Ma]

task_work_add() can fail with -ESRCH if the target task is exiting.
When it fails, the caller must handle the error and free any allocated
resources.

ghes_do_memory_failure() allocates a twcb structure from ghes_estatus_pool
before calling task_work_add(). If task_work_add() fails, twcb is leaked.

This can happen due to a race during task exit:

  do_exit()
    exit_mm()           # current->mm cleared
    exit_task_work()    # task->task_works = &work_exited

ghes_do_memory_failure() checks current->mm before allocating twcb,
but exit_task_work() may run before task_work_add() completes.  At that
point task->task_works == &work_exited, causing task_work_add() to fail.

Fixes the leak by checking the return value and freeing twcb on failure.

Fixes: c1f1fda14137 ("ACPI: APEI: handle synchronous exceptions in task work")
Signed-off-by: Wupeng Ma <mawupeng1@xxxxxxxxxx>
---
 drivers/acpi/apei/ghes.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 8acd2742bb27d..4ffe65ecf4a87 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -520,8 +520,11 @@ static bool ghes_do_memory_failure(u64 physical_addr, int flags)
 		twcb->pfn = pfn;
 		twcb->flags = flags;
 		init_task_work(&twcb->twork, memory_failure_cb);
-		task_work_add(current, &twcb->twork, TWA_RESUME);
-		return true;
+		if (!task_work_add(current, &twcb->twork, TWA_RESUME))
+			return true;
+
+		gen_pool_free(ghes_estatus_pool, (unsigned long)twcb, sizeof(*twcb));
+		return false;
 	}
 
 	memory_failure_queue(pfn, flags);
-- 
2.43.0