Re: "KASAN: slab-use-after-free Write in detach_worker" in Linux Kernel v6.12-rc4

[Tejun Heo <tj@kernel.org>]

On Wed, Jan 15, 2025 at 10:10:26AM +0800, cheung wall wrote:
> Hello,
> 
> I am writing to report a potential vulnerability identified in the
> Linux Kernel version v6.12-rc4. This vulnerability was discovered
> while I was testing the kernel.
> 
> Linux Kernel Repository Git Commit:
> 42f7652d3eb527d03665b09edac47f85fb600924 (tag: v6.12-rc4)
> 
> Bug Location: detach_worker+0x164/0x180 kernel/workqueue.c:2709
> 
> Attached is the bug log file and report file.
> 
> Thank you for your time and attention.

I don't know how reproducible the problem is but can you please see whether
the followign patch resolves the issue?

Thanks.

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 33a23c7b2274..e1d2f8bf28d7 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3516,22 +3516,22 @@ static int rescuer_thread(void *__rescuer)
 			}
 		}
 
-		/*
-		 * Put the reference grabbed by send_mayday().  @pool won't
-		 * go away while we're still attached to it.
-		 */
-		put_pwq(pwq);
-
 		/*
 		 * Leave this pool. Notify regular workers; otherwise, we end up
 		 * with 0 concurrency and stalling the execution.
 		 */
 		kick_pool(pool);
-
 		raw_spin_unlock_irq(&pool->lock);
-
 		worker_detach_from_pool(rescuer);
 
+		/*
+		 * Put the reference grabbed by send_mayday(). This must come
+		 * after the final access of the pool.
+		 */
+		raw_spin_lock_irq(&pool->lock);
+		put_pwq(pwq);
+		raw_spin_unlock_irq(&pool->lock);
+
 		raw_spin_lock_irq(&wq_mayday_lock);
 	}