diff options
| author | Jiayuan Chen <jiayuan.chen@linux.dev> | 2025-04-24 00:17:42 +0800 |
|---|---|---|
| committer | Tejun Heo <tj@kernel.org> | 2025-04-23 06:58:57 -1000 |
| commit | 70e1683ca3a6474360af1d3a020a9a98c8492cc0 (patch) | |
| tree | 09a30c20aea1f9fb27e0425ca5d077f7415adf4f /kernel | |
| parent | 24cdab5787a0ae90260df1f8ac8284877a70b7b3 (diff) | |
workqueue: Fix race condition in wq->stats incrementation
Fixed a race condition in incrementing wq->stats[PWQ_STAT_COMPLETED] by
moving the operation under pool->lock.
Reported-by: syzbot+01affb1491750534256d@syzkaller.appspotmail.com
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/workqueue.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 2cb8276a27a99..f9ef467020cff 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -3241,7 +3241,7 @@ __acquires(&pool->lock) * point will only record its address. */ trace_workqueue_execute_end(work, worker->current_func); - pwq->stats[PWQ_STAT_COMPLETED]++; + lock_map_release(&lockdep_map); if (!bh_draining) lock_map_release(pwq->wq->lockdep_map); @@ -3272,6 +3272,8 @@ __acquires(&pool->lock) raw_spin_lock_irq(&pool->lock); + pwq->stats[PWQ_STAT_COMPLETED]++; + /* * In addition to %WQ_CPU_INTENSIVE, @worker may also have been marked * CPU intensive by wq_worker_tick() if @work hogged CPU longer than |