workqueue: unlink pwqs from wq->pwqs list in alloc_and_link_pwqs() error path

When alloc_and_link_pwqs() fails partway through the per-cpu allocation
loop, some pool_workqueues may have already been linked into wq->pwqs
via link_pwq(). The error path frees these pwqs with kmem_cache_free()
but never removes them from the wq->pwqs list, leaving dangling pointers
in the list.

Currently this is not exploitable because the workqueue was never added
to the global workqueues list and the caller frees the wq immediately
after. However, this makes sure that alloc_and_link_pwqs() doesn't leave
any half-baked structure, which may have side effects if not properly
cleaned up.

Fix this by unlinking each pwq from wq->pwqs before freeing it. No
locking is needed as the workqueue has not been published yet, thus
no concurrency is possible.

Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Tejun Heo <tj@kernel.org>

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 63acaa3e1d6a87ff7476a6ffe38b72f2e1c71d06..4f543da2e7c0ba1c22db47805bc22f2024d6c8c5 100644 (file)
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5624,8 +5624,16 @@ enomem:
                for_each_possible_cpu(cpu) {
                        struct pool_workqueue *pwq = *per_cpu_ptr(wq->cpu_pwq, cpu);
 
-                       if (pwq)
+                       if (pwq) {
+                               /*
+                                * Unlink pwq from wq->pwqs since link_pwq()
+                                * may have already added it. wq->mutex is not
+                                * needed as the wq has not been published yet.
+                                */
+                               if (!list_empty(&pwq->pwqs_node))
+                                       list_del_rcu(&pwq->pwqs_node);
                                kmem_cache_free(pwq_cache, pwq);
+                       }
                }
                free_percpu(wq->cpu_pwq);
                wq->cpu_pwq = NULL;