[PATCH] workqueue: Fix NULL current_pwq deref in chained work check

[PATCH] workqueue: Fix NULL current_pwq deref in chained work check

[Pavankumar Kondeti]

current_wq_worker() only tells us that %current is a kworker. It does
not guarantee that the worker is currently executing a work item, as
worker->current_pwq is populated only while process_one_work() is running
the work function.

is_chained_work() can be reached while queueing on a draining or
destroying workqueue. If a kworker outside work-item execution reaches
that path, current_wq_worker() returns a worker but worker->current_pwq is
NULL, and the chained-work test can fault before it emits the intended
warning.

Guard the chained-work test with worker->current_pwq. A kworker without
current_pwq is not executing work on the target workqueue, so the helper
should return false and let the draining/destroying warning fire.

Fixes: c8efcc258946 ("workqueue: allow chained queueing during destruction")
Cc: stable@vger.kernel.org
Signed-off-by: Pavankumar Kondeti <pavan.kondeti@oss.qualcomm.com>
---
 kernel/workqueue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 959525393739..c56c042d1c35 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -2290,7 +2290,7 @@ static bool is_chained_work(struct workqueue_struct *wq)
 	 * Return %true iff I'm a worker executing a work item on @wq.  If
 	 * I'm @worker, it's safe to dereference it without locking.
 	 */
-	return worker && worker->current_pwq->wq == wq;
+	return worker && worker->current_pwq && worker->current_pwq->wq == wq;
 }
 
 /*

---
base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
change-id: 20260928-wq_chain_fix-9f3814625b1a

Best regards,
-- 
Pavankumar Kondeti <pavan.kondeti@oss.qualcomm.com>

Re: [PATCH] workqueue: Fix NULL current_pwq deref in chained work check

[Tejun Heo]

Applied to wq/for-7.3-fixes with the Fixes tag updated to the commit that
added the unguarded deref:

  Fixes: 8d03ecfe4718 ("workqueue: reimplement is_chained_work() using current_wq_worker()")

Thanks.

--
tejun