[3.11.y.z extended stable] Patch "workqueue: fix a possible race condition between rescuer and pwq-release" has been added to staging queue

Luis Henriques luis.henriques at canonical.com
Fri May 30 09:28:18 UTC 2014

This is a note to let you know that I have just added a patch titled

    workqueue: fix a possible race condition between rescuer and pwq-release

to the linux-3.11.y-queue branch of the 3.11.y.z extended stable tree 
which can be found at:


If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.11.y.z tree, see



>From 738b93f7bd7e432e7ce11a395ecad69294ed7f07 Mon Sep 17 00:00:00 2001
From: Lai Jiangshan <laijs at cn.fujitsu.com>
Date: Fri, 18 Apr 2014 11:04:16 -0400
Subject: workqueue: fix a possible race condition between rescuer and

commit 77668c8b559e4fe2acf2a0749c7c83cde49a5025 upstream.

There is a race condition between rescuer_thread() and

Even after a pwq is scheduled for rescue, the associated work items
may be consumed by any worker.  If all of them are consumed before the
rescuer gets to them and the pwq's base ref was put due to attribute
change, the pwq may be released while still being linked on
@wq->maydays list making the rescuer dereference already freed pwq

Make send_mayday() pin the target pwq until the rescuer is done with

tj: Updated comment and patch description.

Signed-off-by: Lai Jiangshan <laijs at cn.fujitsu.com>
Signed-off-by: Tejun Heo <tj at kernel.org>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
 kernel/workqueue.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 2b48572be9b3..23071c9acdc1 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1894,6 +1894,12 @@ static void send_mayday(struct work_struct *work)

 	/* mayday mayday mayday */
 	if (list_empty(&pwq->mayday_node)) {
+		/*
+		 * If @pwq is for an unbound wq, its base ref may be put at
+		 * any time due to an attribute change.  Pin @pwq until the
+		 * rescuer is done with it.
+		 */
+		get_pwq(pwq);
 		list_add_tail(&pwq->mayday_node, &wq->maydays);
@@ -2421,6 +2427,12 @@ repeat:

+		 * Put the reference grabbed by send_mayday().  @pool won't
+		 * go away while we're holding its lock.
+		 */
+		put_pwq(pwq);
+		/*
 		 * Leave this pool.  If keep_working() is %true, notify a
 		 * regular worker; otherwise, we end up with 0 concurrency
 		 * and stalling the execution.

More information about the kernel-team mailing list